I'd try to find out if a device in my office tries to send packets under different circumstances.
In one case I could see hundreds of packets sent by the specified client. In the other case (the device should send packets through a VPN tunnel) I didn't see any packets.
So I thought the device would't even try to send packets to devices in an other IP range. But it turned out that the Firewall actually dropped the packets (I read the logs then).
Why didn't I see the dropped packets in Wireshark? I mean... They took their way from the client to the Firewall and got blocked there, am I right?
edit here: Me (wireshark) and the sending client are on the same internal network behind the same firewall
Is there any way to monitor packets that got dropped by the FW?