This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 16%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM9%3C/text%3E%3C/svg%3E)
Windows 11 Home, using Sysinternals TCPview64, I noticed inbound connection(s) from the internet through port 2177 (highlighted in blue below), associated with Microsoft's QWAVE protocol, Quality Windows Audio Video Experience. The QWAVE protocol is mainly targeted for use in home networks per Microsoft's documentation. The connection(s) went through my router's firewall and Windows Defender Firewall despite all inbound ports being closed on both. I was able to see the same connection(s) with another network utility.
I did not enable the Windows QWAVE service (it's manual by default). If I stop the service, the connections are immediately disconnected. There is no audio/video equipment on the network or audio/video related software installed on the machine. I was able to repeat this multiple times over a several week period with some other questionable external IPs connecting through it.
How?
