Don’t Trust Packet Captures on Firewalls
Summary
The article argues that built in packet captures on firewalls can be misleading and shows RX vs TX capture discrepancies. It advocates using external network TAPs for truthful visibility, particularly for traffic generated or modified by the firewall. It also points to Jasper Network Capture Playbook parts 4 and 5 and mentions TAP vendors as practical recommendations.