0

We seem to be getting a huge load of entries in our security log with the following details: The Windows Filtering Platform has blocked a connection.

The source IP address and port change for each record and they occur about every few minutes to every few seconds.

Is this something we should be concerned about. The reason we spotted this is because the server performance was very poor on Friday and on inspection found many of these logs in the security log.

Should we be concerned?

Improve this question
  • I deleted my other reply - we have a 2008 R2 server with the same issue but it's not the firewall after all. Does your server have SQL on it, or is it participating in a cluster at all? – Chris McKeown Apr 2 '12 at 14:40
  • What's the destination port? – joeqwerty Apr 2 '12 at 15:33
  • The destination ports vary. In fact they're different for almost each log entry – Jacques Apr 3 '12 at 7:38
  • The server does in fact have sql on it, but it's not part of a cluster – Jacques Apr 3 '12 at 7:38
1

I can't really say definitively whether or not you should be concerned based on your description, but not necessarily. Server 2008's Windows Filtering Platform is really chatty, especially if you have auditing turned on. That traffic could be pretty much anything, from an attack to client PCs trying to discover printers.

Improve this answer
  • Thanks Katherine, it would be useful if it could be slightly more descriptive. – Jacques Jul 19 '13 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.