Firewall outbound rule: which application/service?

[cheer8923]

How do I find out which application or service need outbound connection? I have one application (Citrix XenApp) that fails to connect when outbound is blocked by default. After I added the 2 exe files in XenApp folder, it still fails. Unblock by default fixed it. I would guess a service needs outbound connection. But which one?

thanks!

 

[kjv1611]

Might help looking at the Resource Monitor.

Right-click the taskbar
-> select "Show Task Manager"
--> On the Performance tab, click the "Resource Monitor" button
---> There, you can see what process is doing what in regards to the processor, memory, hard drive, and network.

Of course, in task manager, under the Network tab alone, you'll see at least some of this info. The Resource Monitor may give you the best info.

Next place to look would be the firewall application itself, under events, rules, etc.

Also wouldn't hurt looking under Windows Event Viewer, Windows System messages, and likely for this one under the Application logs (in Event Viewer) and/or it's own logging environment, whatever it may have... if any.

 

[linney]

What Firewall are you using? Most third party Firewalls usually notify you if an application is needing access and allow you to grant such access, temporarily or permanently, or to deny access.

If you have inadvertently denied it you may have to look at the Firewall settings and change them. Is your Firewall able to log what it gets up to?

 

[cheer8923]

Windows Firewall, the built-in one. The problem I have is that there is no way to identify what service needs outbound connection. I don't see any other 2 exe in the task manager when the application is launched successfully with outbound blocking turned off.

I've also tried the free Zone Alarm firewall. It does allow the application to run but it does not say which service needs it -- the item system catch all from c:\Windows\System

 

[linney]

Maybe it is an on-off process like a quick check for updates? Are there any parts of your program that install in the C:\Program Files \Common Files or, C:\ProgramData or, C:\Users\usernamexxxx\AppData\Roaming?

Will a program like this tell you what is going on behind the scenes. Maybe the manufacturer of the program can enlighten you?

Process Monitor v2.8

http://technet.microsoft.com/en-au/sysinternals/bb896645.aspx

 

[cheer8923]

Citrix installed to C:\Users\usernamexxxx\AppData\Roaming. I've added all exe in that folder w/o any success. ZoneAlarm alerted the 2 exe that need outbound connection but nothing else. I think there might be some service involved.

 

[linney]

Is it some plugin that is causing problems?

What about seeing what you can find out at the Support Forum run by the company?

Important Updates

http://support.citrix.com/

Support Forums

http://forums.citrix.com/support

 

[cheer8923]

Citrix forum does not offer much help

 

[linney]

See if you can use this old article about the XP Firewall to identify your mystery process. Have a read of the whole article but in particular the paragraph "Identify ports by using Netstat.exe"

Windows Firewall may block some programs from communicating over the Internet after you install Windows XP Service Pack 2

http://support.microsoft.com/kb/842242

 

[cheer8923]

That does not help as it only identify the server port once the connection is established. I've already allow that to pass the firewall.

 

[BadBigBen]

I'd suggest instead of using ZA, to use Comodo Personal Firewall (also free), as it is more informative as to what where and how some app is trying to connect to the world...

http://www.comodo.com/home/internet-security/firewall.php

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"