{"id":4042,"date":"2026-06-08T18:02:23","date_gmt":"2026-06-08T15:02:23","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4042"},"modified":"2026-06-08T18:02:23","modified_gmt":"2026-06-08T15:02:23","slug":"why-is-there-a-large-amount-of-port-scanning-prevention-filter-entries-in-withsecure-firewall-blocks-log","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fr\/support-articles\/why-is-there-a-large-amount-of-port-scanning-prevention-filter-entries-in-withsecure-firewall-blocks-log\/","title":{"rendered":"Why is there a large amount of Port Scanning Prevention Filter entries in WithSecure firewall blocks.log?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>This article applies to the following products: Client Security 15 and 16 , Server Security 15 and 16 and Elements Endpoint Protection products<\/p>\n<p>I am seeing a lot of the following entries in the firewall blocks.log:<\/p>\n<pre class=\"ckeditor_codeblock\">\n[xxxx.xxxx] \u00a0I: Type: FWPM_NET_EVENT_TYPE_CLASSIFY_DROP. Dropped by filter: Port Scanning Prevention Filter, This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.<\/pre>\n<p>The connection parameters vary, with different local\/remote ports and IP addresses. Do I need to modify my firewall rules for these massages to disappear?<\/p>\n<h3>Resolution:<\/h3>\n<p>These log entries are associated to the\u00a0<a href=\"https:\/\/docs.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2008-R2-and-2008\/dd448557(v=ws.10)\" target=\"_blank\" rel=\"noopener\">Stealth mode<\/a>\u00a0mechanism in Windows Firewall with Advanced Security. It is a built-in functionality, which\u00a0silently drops outgoing ICMP unreachable and TCP reset messages, to prevent port scanning. This functionality reacts when there is no process listening on the port, which is targeted by the incoming request\/traffic.<\/p>\n<p>You can refer to\u00a0this Microsoft\u00a0Technet\u00a0<a href=\"https:\/\/social.technet.microsoft.com\/wiki\/contents\/articles\/18591.windows-firewall-port-scanning-prevention-filter.aspx\" target=\"_blank\" rel=\"noopener\">article<\/a> for more information about this functionality.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I am seeing a large amount of Port Scanning Prevention Filter entries in F-Secure firewall blocks.log, why is that so?<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4042","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000013794","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:02:23","import_hash":"b1b7f56f99f57938fa0a195e8b4e1b768e0785b8","vanilla_article_id":29418,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29418-why-is-there-a-large-amount-of-port-scanning-prevention-filter-entries-in-withsecure-firewall-blocks-log","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article\/4042","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=4042"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article_product?post=4042"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}