logged events are always the same

since i use the comodo firewall, the logs are a bit different as the logs before have been.
first of all, more than 95% of the log is about incoming connection tries on port 135 and 445. the rest are from skype ports, or icmp.
as all blocked events are logged, i ask myself: when in the past many different port connections where blocked, why are (since the using of comodo) suddenly nearly all attempts concentrated on 2 ports, according to the log?
its not a short experience. i decided now to tell about.
there are +65000 ports. and with my old firewall all were logged and blocked.
what should be a reason to log 2 ports, and to ignore the rest?
the applications, that are related to this ports are always:
“system” (TCP 135,445, 95%) or “windows system application” (ICMP, <5%, or very few the UDP, 0,1%).
its not important if i idle or act. always the same logs.
(sometimes games and stuff is logged, but thats a “highlight”).
if you scroll down the log, its totally easy to spot “unusual ports”, i mean, other ports :slight_smile:
if theres another port, then the protocoll was UDP. so, TCP is only on two ports logged. and with ICMP, TCP is 99,9% of the logged events.
i installed cis new, and made all rules new. started with proactive defense. for another reason.

Hi clockwork,

I think this is caused by your global rules setup.
If you have them running default it will probably only log blocked traffic to ports that are really listening on your system.

Can you have a look at your global rules and see if there is a

Block & Log IN IP ANY ANY ANY rule on the last line ?

If this is in place it should cause more logging if you are directly connected and there is no router+firewall between your internet connection and your pc.

Can you run a Shields up test and see how that reports ?
Also maybe post a screenshot of your global rules ?

Are you willing to run a “common port” scan with the FW security level set to disabled ?
Then there should be ports reported as open, if not there is something in between you and the site providing filters…

Okay no problem.