why do I have so many 5156 events

Question

I recently wiped my computer and out of curiosity went to event viewer and saw tons of 5156 and 5158 events. Is this some kind of malware causing this? It seems to be connecting to all these different ip's and ports.

Answer 1

Your screenshots indicate no problem on your system, that is all normal in a modern Windows installation, those are just informational events and do not indicate any problem or malware on your PC, when you are browsing the web or using any app that connects to the Internet, those Audit Success events will be continually generated.

Answer 2

Event ID 5156 means Windows Filtering Platform has allowed a connection. Event ID 5158 means Windows Filtering Platform has permitted a bind to a local port. In the Windows event monitoring table, both are listed with Low potential criticality.

By itself, seeing many 5156 and 5158 events does not mean malware. These events are often generated in large numbers because Windows and installed apps constantly open connections and listen on ports.

From the screenshots, the destinations shown include:

• 239.255.255.250 : 1900
• 224.0.0.251 : 5353

Those are multicast addresses and commonly appear from normal device and service discovery traffic, so repeated entries are expected on a typical home network.

What to check in Event Viewer for each event:

1. Open the event.
2. Look at Application Information and note the Process ID.
3. Check the Source Address, Destination Address, Source Port, and Destination Port.
4. If the same process is generating most of the events, that usually points to one normal Windows component or app doing routine network activity.

A practical way to verify what is making the connections is to use TcpView from Sysinternals. It shows current TCP/UDP endpoints and the owning process in real time, which is easier to interpret than large volumes of Security log entries.

If the concern is unauthorized remote access, the most useful follow-up is to review Windows Security logs for Remote Desktop logon activity and compare the times and source IPs with expected usage.

So the short answer is: many 5156/5158 events are usually normal, and the event IDs themselves are not evidence of infection.

---

• Appendix L: Events to monitor
• How to know if there is a remote desktop connection hack? - Microsoft Q&A