Bad Connections Blocked

Question

With a new Windows 10 computer, McAfee Livesafe is reporting nearly 20,000 bad connections blocked. I ran some tests from Gibson Research, including the UPnP Exposure Test and the All Port Scan. The results were 100% stealth.

This is within a home network using WiFi. There are several IoT devices present, for what it's worth.

I use an IQRouter with no custom configurations (no purposefully opened ports). The router can test susceptibility to outside connections, but only by manually testing one port at a time, so I have not run a thorough scan of the router alone.

How can I determine where these blocked connections originate from and what is the nature of those connection attempts? The AV software gives no obvious option to see these details, but I may be overlooking something.

Answer 1

As a general rule, every security application that performs monitoring or blocking will have a place for you to review any alerts. If it doesn't have that, then it's either useless or a complete fraud.

In your case, there is a detailed view.

Thie picture below was taken from McAfee Knowledge Center article TS102852. You can find the same article by searching "TS102852".

The button is blue in the picture below. This may be due to UI focus, so your button may be the same color as the "Got It" button.

Answer 2

You can look at all current network connections using the windows cli/shell/cmd. This will additional show the process opening the connections.

netstat -nao

Another way would be using a gui application from the windows sysinternal suite. This will show you all tcp connections and the opened ports of you system.

tcpview.exe and portmon.exe

You can download the tool-suite from https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite