OK so what would have happened if I did not have the firewall, would the packets just have been dropped? So they aren’t doing anything? Would turning them off in my router make any difference to anything? I do know that I can turn off UPnP in my router settings but I don’t think it’s possible to change the port number.
With regard to the logging, it's as I explained. Logging is currently handled by cfp.exe, which is a user mode process. This may change in the future.
I'm amazed this hasn't been picked up before. Comodo FW has been around quite a while now. It seems to have gone backwards from when I used to use it a couple of years ago. Perhaps my memory is playing tricks with me. So is there any way at all to see firewall activity from a non-user-mode time?
The packets are being discarded at the moment, which is why you see WOS as the end point. If you want, you can create an application rule for WOS that simply blocks without logging TCP In to port 5000. That way these entries won’t appear in the log.
I'm amazed this hasn't been picked up before. Comodo FW has been around quite a while now. It seems to have gone backwards from when I used to use it a couple of years ago. Perhaps my memory is playing tricks with me. So is there any way at all to see firewall activity from a non-user-mode time?
I guess I’ve never noticed it before because I don’t leave any of my PCs in a logged off state, they’re either on, or being restarted. As far as changing this, right now the process responsible for writing to the log files (cfp.exe) runs in the context of the currently logged on user. As far as I’m aware, this would have to be changed programmatically and I believe there may be a request in to make this change.
Thanks, I’ve set up a rule as you suggest, now I’ll see how it goes.
Hope the log change request is given some priority, it makes me nervous not knowing. I’m surprised you’ve never left it in the logged-off state before. My PC does lots of things in that state,… scheduled antivirus scans, scheduled backups, all sorts of things like that when I’m not there. Anyway each to their own. Thanks again for your help.
“I’ve set up a rule as you suggest, now I’ll see how it goes”
Oh this Comodo firewall just won’t behave, aagghh. I’ve set up the rule and the logging tickbox is NOT ticked yet the entries are still appearing in the logs. ■■■■■■■■■!
IMHO it really really needs something that I’m sure it used to have in previous editions…in the logs next to “Allow” or “Block” it used to put the applicable rule number that “caught” the entry, and the rules were numbered. Can’t imagine why that feature was ever removed (perhaps easier for the programmers?).