faebudo on Nostr: Use pktmon like this: - pktmon filter remove (to remove the filters Defender for ...

Use pktmon like this:
- pktmon filter remove (to remove the filters Defender for Endpoint uses by default)
- pktmon filter add -p 3389
- pktmon start -c --pkt-size 0 -m real-time

It will show the pakets on all layers of the network stack including WPF so you will be able to see the drop reason for the syn pakets.

- pktmon stop

You can also run it without -m real-time and then convert the etl using pktmon etl2txt to get the same output non-interactive.