Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently read a Microsoft Technet article on how Windows Firewall works. The author of the article uses concepts like 'solicited network traffic' and 'unsolicited network traffic' for a machine. I guess I don't fully understand the concept of those.

In relation to TCP protocol, is the solicited traffic a traffic that was initiated by a local machine?

In relation to UDP protocol, is there even sth like a solicited/unsolicited traffic or is all traffic unsolicited?

What about other protocols? (+can Windows Firewall filter those other protocols)

share|improve this question
up vote 5 down vote accepted

Yes, solicited traffic is traffic that was initiated by you. Solicited traffic automatically gets a pass, no matter the port, because you initiated it. This alleviates a lot of the headaches of traditional firewalls, e.g., having to open up ALL the ephemeral ports, because Windows Firewall will keep track of the session state for you.

share|improve this answer
Strange, I could swear that this was Evan Anderson's answer. My eyes must be failing me. – joeqwerty Dec 21 '11 at 3:17
Does 'initiated by me' reference only to the TCP based connection? – colemik Dec 21 '11 at 13:05
Even though UDP doesn't really have the concept of a "connection," most firewalls record the socket pair (source IP + port, destination IP + port) and will allow replies that fit this pattern until a timeout passes without traffic, tearing down the "connection". There is also a similar mechanism known as stateful packet inspection. – Ryan Ries Dec 21 '11 at 14:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.