Windows Security Log Event ID 5154

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019
Category
 • Subcategory		Object Access
 • Filtering Platform Connection
Type Success
Corresponding events
in Windows 2003
and before		 861  
Discussions on Event ID 5154
Ask a question about this event

5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections

On this page

This event documents each time WFP allows a program to begin listening on a TCP or UDP port for incoming connections and documents the program, port and filter that allowed it.

The above example is of WFP allowing the DNS Server service to listen on port 53 for DNS queries.

Application Information:

  • Process ID:  process ID specified when the executable started as logged in 4688
  • Application Name: the program executable on this computer's side of the packet transmission

Free Security Log Resources by Randy

Description Fields in 5154

Application Information:

  •  Process ID:  %1
  •  Application Name: %2

Network Information:

  •  Source Address:  %3
  •  Source Port:  %4
  •  Protocol:  %5

Filter Information:

  •  Filter Run-Time ID: %6
  •  Layer Name:  %7
  •  Layer Run-Time ID: %8

Supercharger Enterprise


Load Balancing for Windows Event Collection

 

Examples of 5154

The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.

Application Information:

   Process ID:  1648
   Application Name: \device\harddiskvolume1\windows\system32\dns.exe

Network Information:

   Source Address:  10.42.42.223
   Source Port:  53
   Protocol:  6

Filter Information:

   Filter Run-Time ID: 65884
   Layer Name:  Listen
   Layer Run-Time ID: 40

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



Mini-Seminars Covering Event ID 5154
Discussions on Event ID 5154
Ask a question about this event

 

Upcoming Webinars
Additional Resources