PKTMON filter not applied

Question

Hello,

I'm trying to use PKTMON to troubleshoot DHCP problems.

After tracking the packets from the source through the network devices, I'm trying to control their reception and response from the DHCP server. A Windows 2022 server.

I wanted to use PKTMON on the same principle as the tcpdump used previously.

However, I can't figure out how filtering works.

I have the same problem on my Windows 11 workstation for a simple ICMP test.

Here's an example:

To view ICMP packets on my workstation, I proceed as follows:

1/ I list the interfaces and find the ID of the component carrying my IP address.

2/ I create a filter on the ICMP protocol

3/ I start real-time capture on the component I've identified. I'm expecting to see only ICMP packets (which I would have generated as a test), but I'm seeing all kinds of packets: TCP, UDP, ...

Can anyone explain the behavior and how to make my filter work?

(Please check the screenshot with commands used?)

Answer 1

Hello Florent,

Your understanding of how filtering should work is probably correct - there is certainly something odd about the output.

In addition to the mismatch between the filter set and the packets captured, the oddities include:

• Apparence values (should be 0)
• Filtre values (should be 1, given the "pktmon filter list" output)
• The second and third capture reports seem to be two appearances (195 and 196) of the same packet (identical PktGroupId and PktNumber values), which is not itself unusual, but with different OriginalSize values (which is unexpected).

This is not normal behaviour - I can't reproduce it. Is there anything unusual (e.g. installed network drivers (perhaps Wireshark npmon or similar)) about the system that you can tell us? Can you reproduce the problem on other systems?

Gary

Answer 2

Hello Gary,

Thanks for your feedback and research. It's a strange situation indeed.

I've reproduced exactly the same situation on a second computer and a Windows 2022 server in my company, and the filters are not taken into account.

However, if I try the same thing on my personal computer, no problem, the filter works fine.

I wonder if deploying EDR on all the machines in my organization isn't the problem.

I'll continue my tests and get back to you if I have any news, and am of course interested if anyone manages to get to the bottom of this.

Best Regards,

Florent