I use Packet Capture in Sophos Firewall WebAdmin every week. It is the quickest way to see what the firewall actually sees. I capture traffic on the appliance, download the PCAP, and check it in Wireshark when I am chasing network faults or odd security logs.
Start in WebAdmin, open Diagnostics, then Packet capture. Pick the interface that sees the traffic, for example WAN for internet-facing issues or LAN for internal flows. Set a capture filter in BPF syntax so the file stays small. Useful filters: host 203.0.113.5 and tcp port 443, src host 192.0.2.50, or net 10.0.0.0/24. Keep the packet limit low for intermittent faults — I use 10000 packets for quick tests. Hit Start, reproduce the problem, then Stop and Download the PCAP. The firewall records packets at firewall level. NAT changes addresses and ports, so note the translation when you analyse the capture.
Open the PCAP in Wireshark. Start with display filters to narrow the view. Display filters are not the same as capture filters. Examples I use often: ip.addr == 192.0.2.50, tcp.port == 443, icmp, and ssl or tls for encrypted sessions. To find retransmits and basic TCP trouble use tcp.analysis.retransmission or tcp.analysis.fast_retransmission. To spot connection attempts use tcp.flags.syn == 1 && tcp.flags.ack == 0. Right-click a packet and choose Follow → TCP Stream to see the full conversation reconstructed. That shows whether a client gets a reply, gets a RST, or just stalls. Use Statistics → Endpoints to list top talkers and Statistics → IO Graphs to spot spikes. Turn on name resolution if you want hostnames, but only for small captures; it slows analysis on large files.
Use packet flags and timings to work out whether you are looking at a firewall rule or a network fault. If a client sends SYNs and never receives SYN/ACK, the usual suspects are a blocked return path, NAT mismatch, or the remote server refusing connections. If the firewall blocks actively you may see TCP RSTs with the firewall’s IP or ICMP unreachable messages. For example, client 192.0.2.50 sends SYN to 198.51.100.20 and the capture shows an ICMP port unreachable from 198.51.100.20; that points at the remote host rejecting the port, not a local rule. If the capture shows the SYN leaving the firewall but no traffic returning to the firewall’s WAN IP, the return path is broken or being filtered upstream. Capture on both sides when possible to see where packets stop. Compare timestamps to work out round-trip time and spot asymmetric routing.
HTTPS and other encrypted traffic need special handling. You cannot read TLS payloads from a PCAP without keys. For deep HTTPS inspection you need the server private key for RSA key exchanges, or session keys from a browser using SSLKEYLOGFILE for modern ciphers. Handle those keys carefully; PCAPs and keys contain sensitive data. Filter out unrelated traffic before sharing captures. Use colour rules and custom columns (Source, Destination, Protocol, Info, Time delta) to speed up pattern spotting. Save the display filters you use most and keep a short checklist of flags to check: SYN behaviour, retransmits, RSTs, ICMP errors, and payload size.
Small rules that save time: start with a tight capture filter, capture on the correct interface, use Follow TCP Stream for the conversation view, check tcp.analysis.* filters, and remember NAT changes. Rotate captures with a packet or time limit so files do not get huge. Treat PCAPs as sensitive evidence when doing security monitoring; redact them or store them securely. Work through the problem in that order and you usually end up with the client, the firewall rules, NAT, or the remote host.
