svchost.exe - Source = UDP out 192.168.x.x Port 123; Destination = 207.46.232.182 Port 123
(90 bytes)
Nothing incoming at all !?
The only svchost.exe entry in App.Mon. I have is: Path: C:\Program Files\ Internet Explorer\iexplore.exe with Parent Path: C:\WINDOWS\system32\svchost.exe (Allow)
There were no prompts to allow deny for the time synchronisation. Do I need to make a rule in App. Mon specifically for svchost.exe with no restrictions at all ?
Experimenting with appmon is a waste of ntp time ;D
To find your answer maybe you should watch the log. I’m pretty sure that ntp requre only an outbound connection so it should work with the standard ruleset.
Use the update now button in the internet time tab and look for blocked packets in the log…
No nothing is blocked, simply no inbound. According to the first post in this thread, incoming UDP needs to be allowed for 123…Comodo Forum
Then CPF Application Monitor that is in my knowledge not
implementing any SPI bookkeeping comes to play.
There needs to be a rule allowing svchost.exe allow incoming
UDP for local port 123 to your computer IP (or your PC's hostname).
Also there is no entry in Component Mon. for svchost.exe. Should there be ?
Maybe I should just disable Windows time in services, as I can do a time synchro. with other apps. that I have installed. On the other hand it would be better if everything is working as it should. :P
If you have the default option enabled: do not show any alerts by the ceritified database … (it’s too long to type out) then you don’t need an AppMon rule.
I don’t know why it shouldn’t, but it’s not on my CM list either.
Maybe you should to save yourself some ram ;D. I certainly have it disabled. Seriously, what you can do as a test is set the security level to Allow All and then see if it works. If it does then we know it’s a rules problem.
This time you could use that rule to enable logging on that port.
regarding component monitor if it is in learn mode you don’t need to do anyting.
But check for w32time.dll in the component monitor to see if it is blocked.
change the default time server in the internet time tab, use the ones which work in the other net time apps.
Sometimes the win32time service complain about a rpc error is this the case?
Thanks Soya. Yes I have always had it enabled. Please see my last post, maybe things have changed and the app. mon. rules are not required. However with or without it’s still no go for me. (My Netmon rules are default). Should I do a scan for known apps. again ?
When that certified app option is enabled it basically bypasses AppMon and goes directly to NetMon (unless you have an AppMon rule blocking svchost.exe, as it would take first precedence). Scan for known apps shouldn’t be needed, but it won’t hurt to try. Finally, a reboot may be needed on some systems.
Time service is allowed in Comp. Mon. (w32time.dll). Setting Comodo to Allow All I still can’t connect. Maybe the server is down. Do you think it may have something to do with Proxomitron ?
I doubt it.
Yeah, will do as nothing seems to work. Even this run command is no good in my case:
w32tm /resync /rediscover.
I will use Query App. - see attachment. It works well.
With these svchost.exe rules my time synchro works.
As you see, incoming is also needed for solicited connections to udp 123.
No ports need to be opened in network monitor though.
You may need to reboot before rules begin to work properly.
Microsoft or gov. Your recommendations ? ;D
Jarmo P has the settings that I tried earlier (except IP address diference), but even after reboot no luck here. Maybe Proxomitron after all.
Have tried the works and now giving up. Too many computer reboots shorten life of HDD ;D
Am quite OK using time-a.nist.gov or one of the other servers per my Query App. screenshot posted before. They all use port 123. time.windows.com is the only one I can’t get (same on wife’s laptop), even with localhost Proxomitron disabled. Maybe it’s one or other security setting … but it did not occur before when running Sygate.
but like reported there 
???
;D