Solved

Firewall Specific App - Still seeing TCP connections pop up


  • Anonymous
  • 0 replies
So I downloaded an app and I set the application to Block in Webroot through the Active Connections screen. When I select the Process in the top window, I still see TCP connections pop up in the bottom window. Should this be happening? I was under the impression that setting it to Block would prevent any connections from being made. Would it make a difference that I am on a VPN?

I apologize in advance if I am posting this in the wrong spot. First time posting here.
icon

Best answer by Anonymous 21 May 2019, 13:10

View original

3 replies

Badge +1
The first step is to use a command-line tool to see what ports are in use, and use a special flag that tells us which port is assigned to each Windows process identifier number.
Already used netstat and tasklist to determine all the ports. All of them use 80 or 443. Also, Runtime Broker also shows up under the process for the application. Unsure if that matters but I've also blocked Runtime Broker in Webroot. Also, no connections are made by Runtime Broker when I check in netstat.

The local IP for the application is different from my local NIC IP or my VPN IP if that matters. I've also blocked all inbound connections in Windows Firewall for the IPs listed under Remote Address in Active Connections for the application in question.
Badge +1
The first step is to use a command-line tool to see what ports are in use, and use a special flag that tells us which port is assigned to each Windows process identifier number.
Any suggestion?

Reply