Firewall Events

This may be a silly question or have been asked before, but why is a request from my outgoing ip address to my incoming ip address being blocked? The source port is always the same. Only the destination port changes. This seems to be the only logged events that I have.

i didnt know that there are different ip`s for outgoing or ingoing.

it would be totally pointless if this was the case. imagine your house has an adress for letters ingoing, and another one for letters outgoing…
you see what i mean? :smiley:

one of these ip`s is yours, and all the other ones are NOT yours.
if YOUR ip is the destination, someone from outside tries to connect.
if YOUR ip is the source, something from your pc tries to connect to the outside.

or make clear what you meant :slight_smile:

Column Descriptions

  Application - Indicates which application or process propagated the event. If the application has no icon, the default system icon for executable files are used;
  Action - Indicates how the firewall has reacted to the connection attempt.
  Protocol - Represents the Protocol application attempted to use to create the connection. This is usually TCP/IP or UDP - which are the most heavily used networking protocols.
  Source IP - States the IP address of the host that made the connection attempt. This is usually the IP address of your computer for outbound connections.
  Source Port - States the port number on the host at the source IP which was used to make this connection attempt.
  Destination IP - States the IP address of the host to which the connection attempt was made. This is usually the IP address of your computer for inbound connections. 

I guess I misinterpreted rules 4 & 6. The source ip and destination ip are from the same block of numbers.
Id Est 192.168.1.254 & 192.168.1.138

Maybe the rules should be made a little clearer. :smiley: For the literal among us.

192.168.1.x that seems to be the ip of your router and the ip which your computer has got from the router.

maybe your router filters every other attempts from outside (on the real ip), so your comodo log is empty apart from these ips. but you should make that sure yourself.
do you have many of these router ip blocking in the logs, or seldom?

i would block, what is not needed. and if all runs, nothing is needed else :slight_smile:

at least we found the “source/destination”.

They are appearing every 2 seconds, 24/7, from an instance of svchost.exe. Always on a UDP protocol.

Can you post a screenshot of the firewall logs? That will help clearing things up.

Here it is. After further investigation, it seems to have only occurred on the 21st. ???

[attachment deleted by admin]