Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We seem to be getting a huge load of entries in our security log with the following details: The Windows Filtering Platform has blocked a connection.

The source IP address and port change for each record and they occur about every few minutes to every few seconds.

Is this something we should be concerned about. The reason we spotted this is because the server performance was very poor on Friday and on inspection found many of these logs in the security log.

Should we be concerned?

share|improve this question
I deleted my other reply - we have a 2008 R2 server with the same issue but it's not the firewall after all. Does your server have SQL on it, or is it participating in a cluster at all? – Chris McKeown Apr 2 '12 at 14:40
What's the destination port? – joeqwerty Apr 2 '12 at 15:33
The destination ports vary. In fact they're different for almost each log entry – Jacques Apr 3 '12 at 7:38
The server does in fact have sql on it, but it's not part of a cluster – Jacques Apr 3 '12 at 7:38
up vote 1 down vote accepted

I can't really say definitively whether or not you should be concerned based on your description, but not necessarily. Server 2008's Windows Filtering Platform is really chatty, especially if you have auditing turned on. That traffic could be pretty much anything, from an attack to client PCs trying to discover printers.

share|improve this answer
Thanks Katherine, it would be useful if it could be slightly more descriptive. – Jacques Jul 19 '13 at 9:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.