i enabled my windows 7 firewall to by default block all outbound connections by default. i configure each and every program that needs network access in the 'Windows Firewall with Advanced Security' mmc. problem is sometimes i cant find the program that needs network access. i enabled firewall logging but that log file does not contain the PID of the process that was blocked.
2010-08-26 17:57:33 DROP TCP 192.168.1.200 188.8.131.52 64883 80 0 - 0 0 0 - - - SEND 2010-08-26 17:57:33 DROP TCP 192.168.1.200 184.108.40.206 64884 80 0 - 0 0 0 - - - SEND 2010-08-26 17:58:10 DROP TCP 192.168.1.200 220.127.116.11 64885 80 0 - 0 0 0 - - - SEND
i know that this connection is triggered by the Games for Windows Live process, but allowing that specific executeable to go through the firewall does not prevent these connections from being dropped. how do i find out what actual program (or service) is trying to open up these connections, so i can make a firewall rule to allow it?