Hello,
i'm trying to troubleshoot a connection problem with the packet filter but in log viewer the id of the rule is correct but not in packet filter.
The rule :
In log viewer :
In packet capture:
Why is it the rule 0 ? The rule 0 is the default drop rule.. All traffic pass without any error, in this case what is it shown in packet filter?
Thank you!
Hi Julian Cast,
Thank you for reaching out to Sophos Community.
With a mentioned BFS string, you'll only be able to see the incoming packets
Firewall rule ID gets marked when traffic gets forwarded from it. You'll be able to see the Rule ID of a packet with 'Forwarded' status.
Please use the below BPF string to get the correct packet capture output.
BPF string: host 192.168.150.35 and proto ICMP
or
host 8.8.8.8 and proto ICMP
or
host 192.168.150.35
