Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When i connect to internet, I often get these firewall notification requests that system.exe is trying to connect

Process: System
Remote Address:, PROTO41

through PROTO41, the address isn't fixed, sometimes it is

Remote Address, PROTO41


Remote Address, PROTO41

OR Any other but it is microsoft's as i resolved.

What's the purpose of it?

share|improve this question
It could be any number of things including verify you have no pending updates and/or syncing your system clock. – Ramhound Jun 22 '11 at 18:06
I receive the updates with no problems, also tried sync my clock. – cpx Jun 22 '11 at 18:16
up vote 3 down vote accepted

I had to check, and I concur that those are Microsoft IP addresses. Here is my explanation the best that I understand it.

Protocol 41 is ISATAP, a protocol that connects IPv6 hosts/routers over IPv4 networks using a tunnel. ISATAP needs a server to create this tunnel, and apparently, Microsoft is providing that for Windows clients.

share|improve this answer

The process is called "System", not "System.exe". (It's part of the kernel and does not have a separate image file.)

Generally, IPv4 protocol 41 is "IPv6". It's not just ISATAP but also the more common 6to4/6in4 tunnels. When Windows sees that you have an "external" IPv4 address assigned (i.e. not behind a NAT), it automatically tries to obtain a IPv6 connection using 6to4 tunnels. (Although 6to4 would normally use as a tunnel server.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.