152 reputation
310
bio website
location
age
visits member for 5 years, 2 months
seen Jul 9 at 23:52

Nov
8
awarded  Tumbleweed
Nov
1
asked Amazon RDS equivalent to dedicated
Jan
8
awarded  Popular Question
Oct
3
revised Large number of security events in the log
specified that the workaround doesn't work unless an option is enabled
Oct
2
revised Large number of security events in the log
link to article with solution
Oct
2
comment Large number of security events in the log
Hardware firewall is out of the budget right now. We have been running other servers in this configuration (without a hardware firewall) for years without problems -- I guess you could argue we were lucky. We run penetration/vulnerability tests all the time.
Oct
2
comment Large number of security events in the log
Servers are hammered by bots with or without a firewall. There's nothing listening on those ports anyway. The firewall stops those attempts, but even without a firewall they wouldn't be successful.
Oct
1
comment Large number of security events in the log
Not sure if needed, but based on the article you linked to I also ran: auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
Oct
1
accepted Large number of security events in the log
Oct
1
comment Large number of security events in the log
Doing it from the GUI didn't seem to work, but this did the trick: "netsh firewall set logging droppedpackets=disable" It did complain that the command is deprecated, but it worked. Thanks!
Oct
1
comment Large number of security events in the log
I disabled the logging of dropped packets (not sure how I didn't notice that settings before), but it doesn't look like it's working (although I did get a "450 - A Windows Firewall setting was changed" event)... investigating...
Oct
1
comment Large number of security events in the log
I'll look into it, thanks. We don't have a domain, hopefully this will work without one.
Oct
1
comment Large number of security events in the log
It has been going on for almost a week now though...
Oct
1
comment Large number of security events in the log
My understanding is that the firewall (software, not a hardware firewall) is blocking these requests and logging every single attempt in the security branch of the events viewer. I used grc.com to test these ports and only the right ports are open, so nothing goes through.
Oct
1
revised Large number of security events in the log
clarification over the event entry
Oct
1
comment Large number of security events in the log
That's what it's doing. The entries in the log are notifications from Windows Firewall that those packets have been dropped. I'll update the question to point this out.
Oct
1
comment Large number of security events in the log
It's a web-server, so it has to.
Oct
1
asked Large number of security events in the log
Sep
30
accepted Optimize Xeon 1270
Sep
20
comment Optimize Xeon 1270
The way I understand it, this Turbo Boost is like an automatic "underclocking" to save power and then when it thinks it needs more power it clocks it back to the "base" (which if I understand correctly is 3.4GHz, anything higher is overclocking, up to a maximum of 3.8GHz), but normally runs underclocked at about 1.5GHz. If there is very little difference between 1.5GHz and 3.4GHz then wonderful, but I would need some kind of test/benchmark. Unfortunately I don't have one in front of me to try things out.