Windows Security Log Event ID 5154
5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
On this page
This event documents each time WFP allows a program to begin listening on a TCP or UDP port for incoming connections and documents the program, port and filter that allowed it.
The above example is of WFP allowing the DNS Server service to listen on port 53 for DNS queries.
Application Information:
- Process ID: process ID specified when the executable started as logged in 4688
- Application Name: the program executable on this computer's side of the packet transmission
Free Security Log Resources by Randy
Application Information:
- Process ID: %1
- Application Name: %2
Network Information:
- Source Address: %3
- Source Port: %4
- Protocol: %5
Filter Information:
- Filter Run-Time ID: %6
- Layer Name: %7
- Layer Run-Time ID: %8
Setup PowerShell Audit Log Forwarding in 4 Minutes
The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Application Information:
Process ID: 1648
Application Name: \device\harddiskvolume1\windows\system32\dns.exe
Network Information:
Source Address: 10.42.42.223
Source Port: 53
Protocol: 6
Filter Information:
Filter Run-Time ID: 65884
Layer Name: Listen
Layer Run-Time ID: 40
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection