Stop all traffic doesn't stop all traffic

I just installed free ver 5.3 and when I click the stop all traffic button I still see packets being sent and received in the status of my network connection.

So; Let me get this right;

You, Fresh installed 5.3 (and restarted)… and open’d CIS and press’d “Stop All Traffic”… then you still had connection to the router/network/internet?

Not full connection and nothing shows up on the active connections list but if I look at the status of the network connection you can see the sent packets and received packets increase. I’ve done an anti virus scan and nothing was found. My previous firewall was Zone Alarm.

Interesting…

Let me get Mr. Miyagi of Networking on this one :slight_smile: (I’ll let another moderator know of this situation)

It may take a day before someone replies :slight_smile:

Sounds Good :slight_smile:
I’ll keep checking back

Thought I would post some more detailed information that may be helpful.
OS - XP Pro SP 3 with all updates. 512 MB of ram
File and print sharing enabled
Wireless network
Router DIR-655
Avast antivirus free ver 6.0
Only installed the Comodo firewall
Haven’t made any special rules as of yet
Ran super antispyware and it was clean

Hmmm …

I just ran a “ping -t www.google.com” and checked I was getting a contonuous stream correctly. I also had a browser session open with some newsfeeds trickling in.

I then clicked the “Stop all traffic” button on the main CIS screen and the streams stopped. Clicking the “Restore all activity” button allowed the streams to recommence.

The only things I had running were a CMD window for the ping test and a browser

Can you try the above test and let us know whether you get the same results or not?

Ewen :slight_smile:

Thanks Ewen for Taking your time and helping ‘us’ out on this one :smiley:

I appreciate it!

In addition to these tests it is possible that Windows shows ‘transmitted’ traffic because windows ‘thinks’ it can transmit while the Firewall drops it before it really reaches the ‘waves’ in this case.

If the ‘receive’ traffic counters are increasing we might have an other issue.
The above tests posted by Panic should bring light to that.

Also make sure Zone Alarm is fully uninstalled. Run the ZA clean up tool, reboot and try again.

Just got back to this after work. I loaded the forum web page and clicked block all. I left firefox opened. All connections disappeared from the list but one. I opened the status for the network connection. I played a game of solitaire and when done I looked at the status I had received 15 packets. I had sent 100 or so.

Can you please turn on “Monitor protocols other than NDIS” and report back the results.

Ewen :slight_smile:

Doesn’t Avast use a local proxy (Web/Network Shield)?

Turned on "Monitor protocols other than NDIS and every thing acted the same.

Avast does have a web/network shield.

Try disabling the Avast Webshield and see what happens.

Stopped traffic and disabled Avast entirely(all shields) received packets still increased while traffic was stopped.

Is this traffic to localhost (127.0.0.1)?

can’t find out where the traffic is coming from. No logs or connection list show the loopback address. It is listed as a zone in Comodo. How can I find out if this is from the loopback. I don’t know if this matters but I stopped traffic and pinged 127.0.0.1. Reported no packet loss. In the status of the network connection it did not show any received packets while pinging.

Pinging 127.0.0.1 while all traffic is stopped via firewall will not block pinging to localhost;
You may want to try to ping www.facebook.com
OR
ping www.google.com

Yes I knew it wouldn’t be blocked. I was curious to see if the status of the network connection would show the pings as received packets and it didn’t.
As expected, a ping to google did not work.
My received packets will continue rise as the PC sits idle with all traffic blocked.