Src-ip - Displays the source IP address (the IP address of the computer attempting to establish communication).ĭst-ip - Displays the destination IP address of a connection attempt. Protocol - The protocol used such as TCP, UDP, or ICMP. The logged actions are DROP for dropping a connection, OPEN for opening a connection, CLOSE for closing a connection, OPEN-INBOUND for an inbound session opened to the local computer, and INFO-EVENTS-LOST for events processed by the Windows Firewall, but were not recorded in the security log. The hours are referenced in 24-hour format.Īction - As the firewall processes traffic, certain actions are recorded. Time - The local time is displayed in the log file using the format HH:MM:SS. Now click the “Private Profile” tab and select “Customize” in the “Logging Section.”ĭate - The date field identifies the date in the format YYYY-MM-DD. On the right side of the screen, click “Properties.”Ī new dialog box appears. The “Windows Firewall with Advanced Security” screen appears. To create a log file press “Win key + R” to open the Run box. Outgoing connections coming from internal servers such as Web servers could be an indication that someone is using your system to launch attacks against computers located on other networks.īy default, the log file is disabled, which means that no information is written to the log file.If you notice repeated unsuccessful attempts to access your firewall and/or other high profile systems from one IP address (or group of IP addresses), then you might want to write a rule to drop all connections from that IP space (making sure that the IP address isn’t being spoofed).To help and identify malicious activity - With the Firewall logging feature you can check if any malicious activity is occurring within your network or not, although you must remember it does not provide the information needed to track down the source of the activity.To determine if Windows Firewall is the cause of application failures - With the Firewall logging feature you can check for disabled port openings, dynamic port openings, analyze dropped packets with push and urgent flags and analyze dropped packets on the send path.

To verify if newly added firewall rules work properly or to debug them if they do not work as expected.

Windows firewall