Use Windows Firewall Log to track activities on the Internet

The Windows Firewall logs are used to fix some problems, such as a program you are using, which cannot be connected to the Internet, but in fact other programs and software are not corrupted.

Windows Firewall logs are used to fix some problems such as:

- A program you are using cannot connect to the Internet. But in fact, other programs and software do not suffer from this error. You then need to take steps to fix the error and make sure that Windows Firewall does not block the program's connection request and deny the service.

- If you suspect your computer is used to transfer data of malware and you want to monitor network traffic after it has been removed on the Firewall, suspicious connection requests are required.

- Create a new rule on Firewall to allow or block connection and adjust as you like.

1. Access Windows Firewall

The first is to access the Windows Firewall Advanced settings. Open Control Panel then on the Control Panel window, under View by , if you set it to Small / Large icon , find and click Windows Firewall .

If View by setting is Category , you can find and click System and Security , then click Windows Firewall.

On the Windows Firewall window, find and click Advanced settings in the left pane.

Now on the screen that displays the window as shown below:

Here you can set whether to allow or block any program from accessing the Internet.

2. Access Log Settings

In the window that appears, find and select 'Windows Firewall with Advanced Security on Local Computer' in the left pane.

Right-click it and select Properties.

The Properties window appears. Here you can see profile tabs:

Domain Profile : When your computer connects to Wifi to a network, where the domain (domain) is provided by the domain controller. If you are unsure about anything, you may not use this profile.

Private Profile : When connecting to a "private" network, including the Home Network and Personal Network.

Public Profile : Connected to the "public" network. This profile is used when connecting to public Wifi such as Wifi at the airport, library, .

If you are connected to a private network, click the Private Profile tab. If connecting to the public network, you access the Public Profile tab. After selecting the correct tab, click on 'Customize .' in the Logging section.

3. Start the login process

On this window you can set the location and size of the log file. You can set a memorable location for the log file. If you want to login now, just change the dropdown menu to Yes and click OK.

To turn it off, you can simply select No from the dropdown menu.

4. Read the log file

Now your computer has access to all Firewall activities. Now go back to the Advanced Settings window, click on Monitoring in the left pane, in the Logging Settings section, click File Name .

The log window appears at this time. Here is the important information you need to pay attention to:

1. The date and time of the connection.

2. What happened to the connection."Allow" means that Firewall allows your connection to pass, while "Drop" means that the connection is blocked.

3. Connection type, TCP or UDP.

4. Order: the original IP of the connection (IP address of the computer), the destination IP (such as the website's IP address) and the port (port) used on your computer.

5. Have a connection or no connection on your computer when sending or receiving a packet.

Don't forget to turn off the logger after completing the process.

Refer to some of the following articles:

1. How to block or unblock programs on Windows Firewall?

1. Instructions allow applications to communicate with each other via Windows Firewall

1. Instructions to enable / disable Windows Firewall with Command Prompt

Good luck!