Windows Firewall does not record discarded packets by default. You need to manually enable the logging function through the Windows Firewall Advanced Security Settings: 1. Press Win R to enter wf.msc to open the firewall Advanced Security interface, and configure the recording settings of three configuration files: domain, dedicated and public; 2. Click "Custom" in the recording options of each configuration file, set "Record discarded packets" to "Yes", optionally enable allowed connection records, and confirm the log path (default %systemroot%\system32\logfiles\firewall\pfirewall.log) and file size limit (default 4MB, maximum 32MB); 3. Ensure that the firewall service has write permissions to the log directory, and it is recommended to use the default path to avoid permission problems; 4. After enabled, the log will contain information such as time, source/destination IP and port, protocol type and operation (DROP), which can be used to troubleshoot network problems or security monitoring; 5. For effective monitoring, logs should be archived regularly to prevent overwrites. You can use PowerShell scripts, Event Viewer or third-party tools such as Splunk for analysis; 6. During testing, you can create outbound rules that block specific ports (such as 80) and access the web page to verify whether the corresponding DROP records appear in the log, so as to confirm that the function is normal. Although it cannot provide complete packet capture details like Wireshark after activation, it is sufficient to identify blocked connections and potential security threats, and is a simple and effective audit method.

Windows Firewall doesn't log dropped packets by default, and the logging feature needs to be manually enabled through the built-in Windows Firewall with Advanced Security. Here's how you can configure it to log dropped packets for troubleshooting or security monitoring.

1. Enable Windows Firewall Packet Logging

To start logging dropped packets, you need to modify the logging settings in the Windows Firewall with Advanced Security:

1. Press Win R , type wf.msc , and press Enter to open Windows Firewall with Advanced Security .

   

2. In the left pane, click on Windows Firewall Properties .

3. In the main window, you'll see three profiles:

   
   • Domain Profile
   • Private Profile
   • Public Profile

   You need to configure logging for each profile individually.

4. For each profile:

   • Under the Logging section, click Customize next to "Logging".
   • Set Log dropped packets to Yes .
   • Optionally, set Log allowed connections to Yes if you want a full audit trail.
   • Specify the Log file path (default is %systemroot%\system32\logfiles\firewall\pfirewall.log ).
   • Adjust the Log file size limit (default is 4 MB; increase if needed to retain more data).

5. Click OK to save changes.

?? Note: The firewall service must have write permissions to the log directory. Using the default path usually avoids permission issues.

2. Understanding the Log File

Once enabled, Windows will write dropped packet events to the specified log file ( pfirewall.log ). Each entry includes:

• Date and time
• Source and destination IP addresses and ports
• Protocol (TCP, UDP, ICMP, etc.)
• Action taken (DROP)
• Interface type

Example log entry:

 2025-04-05 10:23:45 DROP TCP 192.168.1.100 192.168.1.1 54321 80 0

This means a TCP packet from 192.168.1.100:54321 to 192.168.1.1:80 was dropped.

3. Tips for Effective Monitoring

• Check log size and rotation : Since the log is limited in size, it will overwrite old entries when full. For long-term monitoring, consider:
  • Increase the log size (up to 32 MB).
  • Setting up a script to archive logs periodically.
• Use tools to parse logs : The log is plain text but can be hard to read manually. Use tools like:
  • PowerShell scripts to filter entries.
  • Event Viewer (though dropped packets don't appear in the main event logs).
  • Third-party log analyzers (eg, Splunk, LogParser, or even Excel with text import).
• Filter noise : By default, Windows may drop expected traffic (eg, unsolicited inbound packets). Focus on patterns (eg, repeated drops from the same IP) rather than isolated events.

4. Verify Logging is Working

To test:

1. Temporarily block a port (eg, create an outbound rule to block port 80).
2. Try accessing a website (generates traffic on port 80).
3. Check the log file to see if DROP entries appear.

You can also use tools like ping (blocked by default in some profiles) or telnet to generate test traffic.

Basically, enabling dropped packet logging in Windows Firewall is straightforward through wf.msc , but interpreting the logs require some familiarity with network traffic. It's not as detailed as a full packet capture (like Wireshark), but it's useful for identifying blocked connections and potential security issues.

The above is the detailed content of How to log dropped packets in Windows Firewall. For more information, please follow other related articles on the PHP Chinese website!