3

I'm running Windows 2008 R2 and I have IIS7/MySQL hosting several websites. However, I've recently been having seemingly random connection errors, perhaps one out of 50 times.

I took a look at the event viewer and there are lots of blocked packets to post 80 from many different IPs at the time of the problems, including my own (event viewer log attached at bottom of post).

It looks like WFP is blocking some legitimate requests, but I've set up the firewall to allow all port 80 web traffic connections... so how can they be blocked?

LOG:

The Windows Filtering Platform has blocked a packet.

Application Information:    
    Process ID:     0   
    Application Name:   -

Network Information:    
    Direction:           Inbound
    Source Address:      xxx.xxx.xxx.xxx
    Source Port:         57578
    Destination Address: xxx.xxx.xxx.xxx
    Destination Port:    80
    Protocol:            6

Filter Information:
    Filter Run-Time ID:  74587
    Layer Name:          Transport
    Layer Run-Time ID:   13
1
  • So, what are the contents of the other filters you have? Sounds like another fitler might be blocking these packets.
    – Aaron
    Oct 7, 2011 at 20:21

2 Answers 2

5

If you really want to get the bottom of this kind of problem you will have to perform a WFP (Windows Filtering Platform) capture.

To start a capture use the following command:

netsh wfp capture start

Then you should reproduce your problem to include it in the capture. After that you use the following command to stop the capture:

netsh wfp capture stop

The result of the capture is stored in the file wfpdiag.cab in the current directory. I believe this file only is intended for internal use by Microsoft but if you want to you can extract the two files in the archive and have a look yourself.

The .etl can be opened using Event Log. However, I'm not sure how to interpret the contents. The interesting file is the .xml file. If you spend some time you should be able to figure out the structure of the contents. What you should be looking for is the following:

Filter Run-Time ID: 74587

By inspecting the XML you need to find which filter has run-time ID 74587. This will tell you which rule in the firewall blocked the connection. Note that the firewall has some hidden rules (e.g. Windows Firewall service hardening rules).

1

As mentioned here, it is likely these Event Log entries (with Event ID 5152) are due to malicious requests, possibly sent by legitimate users of your web site that have virus infected machines. Viruses such as Code Red propogated in this manner by infecting IIS powered websites. IIS/WFP is most likely blocking and logging the malicious requests.

Assuming that this is the case, there's not much to do here. If you determine that all of the requests are coming from one IP, you could block that IP at the firewall level. If they're from all over the place and you don't want to be bothered with the Event Log entries anymore, then you could turn off the Audit Logging of these events (not that I would necessarily recommend doing so). If you do want to disable logging, you can make use of the auditpol.exe command.

View the Audit Logging settings for Events 5152 and 5153:

auditpol /get /subcategory:"Filtering Platform Packet Drop"

Disable the Audit Logging of failures for Events 5152 and 5153:

auditpol /set /subcategory:"Filtering Platform Packet Drop" /failure:disable

More information on the Audit Policies be found at:
http://msdn.microsoft.com/en-us/library/windows/desktop/bb309058(v=vs.85).aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .