-1

is it possible to block all packets in windows 7, so that nothing appears in wireshark?

I have tried choosing Block all for incoming.

for outgoing, I see it has no block all option, just a block option so it's a whitelist. I tried that and disabling all the allow rules in incoming and outgoing. (if I recall I blocked outgoing and for good measure made a rule to block tcp and to block udp) I tried public profile too(it being more restrictive), and disabled anything in allowed programs.

but I still see traffic going through. ARP(I saw no option to block that), but not just ARP Even UDP and even some TCP.

UDP DHCPv6 a comp on my lan to IPv6 multicast
BROWSER IPv4 UDP NETBIOS (one comp on my lan broadcasting to 192.168.1.255)
BROWSER IEEE 802.3 LLC .. SMB
DB-LSP-DISC (a comp on my lan with dropbox, broadcasting to 255.255.255.255 and 192.168.1.255)
NBNS   IPv4 UDP NetBIOS  me to 192.168.1.255
NBSS  IPv4 TCP NetBIOS a comp on my lan to me
SSDP  IPv6 UDP comp on LAN to IPv6mcast
"TCP" IPv4 TCP a comp on my LAN to me
IPv4 IGMP
ARP

It looks like the Windows firewall can't do it. But, can anything?

It'd be great to be able to disable everything in the sense of stopping all packets, so wireshark shows nothing, then to allow what I want. Not necessarily for any practical reason, but out of curiosity.

5
  • How about just disabling the network interfaces?
    – hookenz
    May 8, 2014 at 23:44
  • @Matt see the last 2 lines of my question
    – barlop
    May 8, 2014 at 23:57
  • It's about as useful as asking, "what happens when I delete the /windows directory?". Not necessarily for any practical reason, but out of curiosity.
    – hookenz
    May 9, 2014 at 1:02
  • @Matt No. And it's not just curiosity. It actually makes sense for a firewall to be able to block everything and if it can and you can then allow what you want then it's clear what it's doing and it offers a good amount of control in a logical way with clear rules on what it is and isn't allowing so that you know.
    – barlop
    May 9, 2014 at 1:58
  • Ahh, sorry I kind of misread. Should have read it more carefully. I think a better question is, why aren't my blockrules blocking? wireshark still shows data.
    – hookenz
    May 9, 2014 at 2:21

2 Answers 2

1

I may be mistaken, but I believe Wireshark sits lower (or perhaps the same level) on the network stack than the Windows Firewall. So even if the Windows Firewall is actually "blocking everything", Wireshark will still see attempted incoming and outgoing packets. There just won't be any network "converstations" because they're all being blocked.

1
  • I don't think it works like that. Because I am not seeing a ton of things in wireshark. The fact that i'm not seeing a ton of things in wireshark(as I would if blocked things still showed up there), that implies that things that are blocked do not show up in wireshark. What you suggest is that wireshark would still see all sorts of things, VNC, webpage requests, even when blocking, but that is not the case.
    – barlop
    May 8, 2014 at 22:43
0

I think the setting your looking for is here:

http://i58.tinypic.com/24yn489.png

After setting this, outbound will default block, and rules will be allow instead of block.

1
  • you have not read the question beyond the title. I actually mentioned that step already. And no picture is necessary.
    – barlop
    May 8, 2014 at 23:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .