Recent Hard disk activity [RESOLVED]

Recently I’ve noticed my hard disk drive is making repeated sounds or activity in these 2 second intervals. The only way to stop the activity now is to put the firewall in “block all mode”.

Looking through the active connections, there is nothing active. Therefore, I have no idea what is causing the hard disk to become active.

Again, this is a new symptom.

  • CPF v3.0.16.295
  • Cable/LAN
  • XP x64 sp2
  • Computer Admin

[Topic Closed: If issue returns PM an online mod to open]

Look at the log for something being blocked and logged, probably in Windows Operating System. Usually there is router or housekeeping traffic that can cause things like this. If you find something, add a rule to block and not log and the disk traffic should go away. You won’t see ICMP/IGMP in the active connections.

Thanks sded. You’re right. It is something being blocked. Several different ip address all trying to access port 46224.

How do I change the log settings?

The way to turn off the log for individual messages is to go to firewall/advanced/network security policy and make an explicit rule to block and not log under whatever application it is going to. If all your stuff is going to 46224, for example, and are sure you don’t need to allow it, block/udp&tcp/in/any/any/any/46224 will turn off that specific logging. You may need to open it up a bit if other inputs are pestering you, but that is generally how to do it. If it is going to WOS and WOS is not already on the list, you can find WOS under “select/running processes” and make the rule for it. Then add if necessary. :slight_smile:

Thanks again. I applied your advice for advanced/network security policy and added the specific rule. The reason I was confused was because there was a rule that was used to block and log all unmatching tcp or udp requests. Not sure what unmatching are.

I’m not sure what WOS is. Windows Operating System? If so, then yes the blocked log reads windows operating system. And by “list”, do you mean the network security policies?

Unmatching means those events that don’t match any of the rules above. You could just turn off the log there, but sometimes it is useful to see if something unexpected is coming in, so you can decide to block or allow. WOS is Windows Operating System and is just a catchall for incoming traffic that is not routed to any particular application. On earlier versions of CFP it was called “System Idle Process”. Yes, by the list I mean the list of applications under Network Security Policy. :slight_smile:

Well done. Again, I appreciate all the help. =)

Glad to help. :slight_smile: I’ll mark this thread resolved, then.