I have an application that connects to a License Server. The application triggers the request to allow connections on Windows XP and up. No matter whether I block or unblock the application, it gets it's license. The rules appear to be correct (both deny and allow).

By default, the Windows Firewall allows outgoing connections and disallows all incoming connections. I reset the Windows Firewall to default settings. So this should be no problem.

Using TCPView from Sysinternals I could not see the application opening any listening ports.

Using Wire Shark I could confirm, that I had not overlooked anything that happened too fast for TCPView.

So the Windows Firewall should not ask for permission. But it does! Why?

1 Answer 1


Taking a second look at the Wire Shark capture, I saw that the application uses a portmap request to get the port of the actual license server. That portmap request uses a (seemingly random) source-port below 1024 - which is unusual or maybe plain wrong. The portmapper duly answers to that port. To give an example, let's say the Dialog between client and server looks like this:

Source: Client.Domain:1001 Destination: Server.Domain:111 Data: "Where do I find the License Server?"

Source: Server.Domain:111 Destination: Client.Domain:1001 Data: "On Port 12345. You're welcome."

111 is the well known port for Portmapper. That's okay. 1001 is below 1024 that seems unusual for a source port.

First guess

The Windows Firewall seems to follow a simple logic: if something talks to some local port below 1024, it's incoming and I have to ask for permission. Thus the window pops up.

Second guess

Before the Windows Firewall actually discards a packet, it does a better check and recognizes the connection was actually initiated by a local process. Thus it is recognized as an outgoing connection and thus allowed (no matter what the user answered, because the rule created only applies to incoming packets)

  • Unless the license is actually on the same hardware it seems to me the software actually is sending both outgoing and incomming data. Which makes your conclusion about Windows Firewall more/less correct in the sense that it figures out what is actually happening and requests permission.
    – Ramhound
    Mar 6, 2013 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .