Share via

packet size of windows firewall log is zero

Hongde Liu 26 Reputation points
2020-09-07T08:24:26.8+00:00

when I use log feature of windows firewall, I find that there are many log data with packet size 0 , can somebody tell me what does it means？

  1. Enable windows firewall (LogAllowed and also LogDropped enabled)
  2. Open a website in the browser ， and request some websie , such as microsoft.com
  3. Check the windows firewall log C: Windows / system32 / logfiles / firewall

2020-09-07 10:42:21 ALLOW TCP ip1 ip2 63370 8080 0 - 0 0 0 - - - SEND

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,838 questions
Accepted answer
  1. Gloria Gu 3,896 Reputation points
    2020-09-08T07:06:26.07+00:00

    Hi @Hongde Liu ,

    23261-38.png
    size：Displays the packet size, in bytes.
    tcpflags：Displays the TCP control flags found in the TCP header of an IP packet
    tcpsyn：Displays the TCP sequence number in the packet.
    tcpack：Displays the TCP acknowledgement number in the packet.

    Since the size & syn is 0, it indicates that the source port sent an empty SYN pocket. If you want to establish an successful TCP connection, it must begin with the SYN pocket containing some data. The statetics means that it's an invalid TCP pocket.

    For more details about the Tcp connection establishment and three-way handshake, please refer to
    introduction-to-tcp

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gloria Gu 3,896 Reputation points
    2020-09-08T03:06:17.4+00:00

    Hi,

    In regards to your issue, may I ask that what method do you use to configure firewall logging? Through GUI or GPO?
    Because with both two method, the packet size is neither 0 after my test. So with the correct configuration, the situation you described should not appear.
    23153-35.png

    It is suggested that you can check the Registry key of firewall logging. Domain Profile for example:
    23154-33.png

    Then you can check both Public Proflie & Standard Profile.
    23125-36.png
    23155-37.png

    If the value is all good, you can close and enable the firewall logging again to check the result.

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentationhttps://learn.microsoft.com/en-us/answers/articles/67444/email-notifications.html to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  2. Hongde Liu 26 Reputation points
    2020-09-08T03:38:49.733+00:00

    Hi @Gloria Gu 

    Many thanks for the prompt reply.   

it has no relationship with LogFileSize setting, but the "size" field within log file

    Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path

    https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ff824015(v=vs.85)  


there are many data with "0" size in log file  %systemroot%\system32\LogFiles\Firewall\pfirewall.log  

2020-09-07 10:42:21 ALLOW TCP ip1 ip2 63370 8080 **0** - 0 0 0 - - - SEND  

hmm... my question is why there are many data log with "0" size in log file .
  3. Hongde Liu 26 Reputation points
    2020-09-08T07:14:21.37+00:00

    Hi @Gloria Gu 

    Thanks. Got it.