Windows filtering platform has blocked a packet protocol 6

This issue may be caused by incorrect Firewall settings or conflicts of software. Switch to Startup tab, click Disable all. Click OK to restart. Elytis Cheng. TechNet Community Support. Office Office Exchange Server. Not an IT pro? Resources for IT Professionals. Sign in.

United States English. Ask a question. Run Netsh. This is the filter that is causing the block. I ran the Netsh command and found that the offending filter is the 'Port Scanning Prevention Filter'. I can't seem to find any way to disable this filter, though. Do you know if this is possible, or at least to omit port from hitting this rule? These audits are indicative of likely stack drops.

What most likely is happening is someone is attempting to connect to your machine, which at the moment is not listening on port Rather than think of this as a filter issue, you should be trying to fix the traffic issue.

I'm seeing the same packet filtering happening on one of our 2k8r2 DCs - port traffic between it and other DCs - but I only see this on one of them. I did the netsh command and looked up the filtering rule and it's the same "Port Scanning Prevention Filter" Baker found. I follow your reasoning that it's a traffic or load related issue but am not seeing excessive traffic or load anywhere.

Nobody is complaining, but the number of these packet drop events really points to something being very, very wrong. Any ideas what to start looking at? But these failure audits are occuring on a Windows Server DC and if it wasn't listening on port then our Active Directory wouldn't be working. Below are these packets being captured in a Wireshark trace. I have the same events on our newly installed win2k8R2 DC. I also se the same behavior on other ports like etc etc.

Just shooting in the dark, but many servers and desktop have had a Microsoft Security Update that might be what you are seeing.

I know, because it caused some internal headaches with this release. June 13, Microsoft has released KB This is an update that protects from internal URL port scanning. It protects an external network from verifying whether a uniform resource identifier URI port on an internal network is open or closed.

You also need to copy the DevCon tool to the target computer. On the target computer, navigate to your driver package folder. On the target computer, open a Command Prompt window as Administrator, and enter net start ddproxy. To stop the driver, enter net stop ddproxy. For outbound traffic, Ddproxy. For inbound traffic, Ddproxy. This redirection is transparent to the application. Packet modification is done out-of-band by a system worker thread by using the reference-drop-clone-modify-reinject mechanism.

Skip to main content.