I’ve been using tcpview utility for a long time. I can see there is quite a difference between the connections shown within tcpview and those in CIS’ View Active Connections window. What’s the reason behind it? tcpview shows many more connections, even with “show unconnected endpoints” off.
Also, there is cmdagent.exe connected to download.comodo.com and downloads.comodo.com (usually at CLOSE_WAIT state). What is this for, considering the fact that CIS auto-updates are off (and I don’t have any permanent rule to allow cmdagent.exe connect at any time)? Are there any “hard-coded” rules within CIS?
View Active Connections has been discussed a number of times on the forum, unfortunately, the bottom line is, it’s simply not very good. The information it displays bears little relationship to that shown in othet network viewers, it’s slow to update uses a different name for one process. Rumour has it, it will be replaced in a future version of CIS, probably with COMODO Cleaning Essentials or at least the Killswitch component.
Also, there is cmdagent.exe connected to download.comodo.com and downloads.comodo.com (usually at CLOSE_WAIT state). What is this for, considering the fact that CIS auto-updates are off (and I don't have any permanent rule to allow cmdagent.exe connect at any time)? Are there any "hard-coded" rules within CIS?
Cmdagent is responsible for various updates and cloud lookups, all of which can be disabled. The rule that controls it is the Application rule for Comodo Internet Security, which is a pointer to a group with the same name in D+.