Firewall and Information leak

Question

Conducted security tests on software that can connect to external networks on Windows 10.
Before and after startup, I confirmed that the number of access destinations from the outside did not increase with "netstat –a" from the command prompt.
At this time, when the firewall (Windows) was ON, the number of connection destinations from the PC increased.
If the firewall is on, does it behave like connecting to a Microsoft server when the software is running?

Answer 1

Hi,

Welcome to Q&A platform.

If the Windows Firewall was turned on, all rules would be activated. My understanding is when Windows Firewall was enabled network traffic will be less than when windows firewall was disabled. When Windows Firewall was on, some port might be blocked and some protocol might be disabled, if you have configured some specific rules, network traffic from remote IP will be allowed or restricted via Firewall. If Windows Firewall was disabled, all network traffic will be sent to of sent from our device.

I have tested in my lab and found that when Windows Firewall was enabled, network traffic hasn't increasing numerously.

I would like to suggest you investigate the IP address from destination in the "netstat -a" result is used for which service or this IP address belongs to which device.

Best Regards,
Sunny

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thank you for suggesting.

Best Regards,
masa