avast 101125-2
comodo 5.0.16 2636 1135
firefox (3.6.12)
windows xp pro sp3
Request - can the firewall list the destination IPs in the event viewer for firefox page requests?
Background: I wanted a list of all the IP addresses my pc had called in the last hour as I think this is a useful thing to keep an eye on and a feature that I’ve used in other firewalls.
So I created a global rule for all IP traffic and requested each was logged as an event.
This worked and the event viewer showed the details, except the destination IP for firefox was always 127.0.0.1.
This is because Avast antivirus web shield does all the communication with the outside world reading requests sent via internal ports. However avastsvc.exe is not logged as ever communicating with anything.
The firewall logs a html page request as just one firefox event - which is fair enough really - and ignores all the internal chatter between all the various threads and processes.
Although the firewall is technically right in logging that firefox only communicates with local ports, I think the more important detail is the external IP address that it is getting information from.
Alternatively, perhaps both executables should be recorded for each event.
Many thanks.
R Day