Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running into an issue with traffic from a webapp server to a database server being blocked or filtered. I have allowed inbound and outbound traffic on the needed ip and port with a firewall rule, but some packets/connections are still being blocked/dropped.

In the event log for the most recent occurrence I see:

The Windows Filtering Platform has blocked a packet.

Application Information:
    Process ID:        0
    Application Name:    -

Network Information:
    Direction:        Inbound
    Source Address:        redacted-webapp-ip
    Source Port:        51888
    Destination Address:    redacted-database-ip
    Destination Port:        1433
    Protocol:        6

Filter Information:
    Filter Run-Time ID:    72605
    Layer Name:        Transport
    Layer Run-Time ID:    13

With the output from netsh wfp show state I can find this information about the filter that caused the drop:

        <name>Port Scanning Prevention Filter</name>
        <description>This filter prevents port scanning.</description>
    <filterCondition numItems="1">

Can anyone point me in the right direction on determining the cause of this? Any way to tell what is adding/has added this filter?

No antivirus software was installed and I couldn't locate any other software that looked suspect. In addition to the "Port Scanning Prevention Filter" I have also seen one named "Query User" (causing similar issues) which I cannot track down the origin of either. (Other legitimate traffic outside of this example is periodically being blocked by these types of filters too.)

share|improve this question
I'm having a similar issue which is causing dropped connections to my SQL box. Did you find a resolution to this? My question is -… – Matthew Abbott May 5 '15 at 13:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.