System.exe trying to connect microsoft ISP

Question

When i connect to internet, I often get these firewall notification requests that system.exe is trying to connect

Process: System
Remote Address: 94.245.121.212, PROTO41

through PROTO41, the address isn't fixed, sometimes it is

Remote Address 94.245.121.221, PROTO41

OR

Remote Address 94.245.121.204, PROTO41

OR Any other but it is microsoft's as i resolved.

What's the purpose of it?

Answer 1

I had to check, and I concur that those are Microsoft IP addresses. Here is my explanation the best that I understand it.

Protocol 41 is ISATAP, a protocol that connects IPv6 hosts/routers over IPv4 networks using a tunnel. ISATAP needs a server to create this tunnel, and apparently, Microsoft is providing that for Windows clients.

http://en.wikipedia.org/wiki/ISATAP

http://isatap.org/

http://technet.microsoft.com/en-us/library/dd630627(WS.10).aspx

http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/09016c42-20c9-4a2c-90a6-50fb4eb00daa

Answer 2

The process is called "System", not "System.exe". (It's part of the kernel and does not have a separate image file.)

Generally, IPv4 protocol 41 is "IPv6". It's not just ISATAP but also the more common 6to4/6in4 tunnels. When Windows sees that you have an "external" IPv4 address assigned (i.e. not behind a NAT), it automatically tries to obtain a IPv6 connection using 6to4 tunnels. (Although 6to4 would normally use 192.88.99.1 as a tunnel server.)