Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When i connect to internet, I often get these firewall notification requests that system.exe is trying to connect

Process: System
Remote Address:, PROTO41

through PROTO41, the address isn't fixed, sometimes it is

Remote Address, PROTO41


Remote Address, PROTO41

OR Any other but it is microsoft's as i resolved.

What's the purpose of it?

share|improve this question
It could be any number of things including verify you have no pending updates and/or syncing your system clock. – Ramhound Jun 22 '11 at 18:06
I receive the updates with no problems, also tried sync my clock. – cpx Jun 22 '11 at 18:16
up vote 3 down vote accepted

I had to check, and I concur that those are Microsoft IP addresses. Here is my explanation the best that I understand it.

Protocol 41 is ISATAP, a protocol that connects IPv6 hosts/routers over IPv4 networks using a tunnel. ISATAP needs a server to create this tunnel, and apparently, Microsoft is providing that for Windows clients.

share|improve this answer

The process is called "System", not "System.exe". (It's part of the kernel and does not have a separate image file.)

Generally, IPv4 protocol 41 is "IPv6". It's not just ISATAP but also the more common 6to4/6in4 tunnels. When Windows sees that you have an "external" IPv4 address assigned (i.e. not behind a NAT), it automatically tries to obtain a IPv6 connection using 6to4 tunnels. (Although 6to4 would normally use as a tunnel server.)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .