Blocking 'System'

[MartenvanWezel]

When I'm looking at the current connections i often see windows 'System' Process that is reaching out to a bunch of remote IPs. How do I block this? Not in the FAQ so it's.. a wildcard?

[pylorak]

'System' is not a wildcard, it is the kernel (and any drivers running inside it). It should be blocked by default, though I guess it is possible for a driver that is already installed to circumvent the BFE filters. But standard Windows stuff should not be doing that. Are you sure those are active communications and not just open ports? Open ports still cannot be connected to unless whitelisted in TinyWall.

[tnodir]

ping.exe, tracert.exe also connect as "System".

[pylorak]

Yeah, that's ICMP traffic, which is handled specially by the kernel. It kinda has to, given that ICMP traffic plays a large role in IP routing, connectivity and error diagnostics. TinyWall lets a safe subset of the ICMP messages through globally for all applications, courtesy of the "Filtered ICMP Traffic" special exception. The word "filtered" here is meant to signify that not everything that is ICMP is let through, but only what is considered safe and necessary for basic networking.