Audit failure alerts -- what to do

[dale5351]

(not sure if this is the correct sub-forum -- if not, please point me to a better one).

I am getting consistent frequent messages in my event viewer about
The Windows Filtering Platform has blocked a connection.
Further down, it says "audit failure".
The current set of messages is from ap name = system, inbound, source address 224.0.0.1 to destination address of 192.168.1.1 (which is my Verizon router).

My questions are:
1. is this an indication of some sort of problem?
2. how do I stop the message from flooding my event log (currently occuring about every 9 minutes).

 

[torchwood]

Hi Dale,

It would depend on whether your Firewall is part of your AV suite, or the standard MS built-in.

What is the event ID 5152/5157?


Roy

 

[dale5351]

My firewall is standard Win firewall, virus suite is Avast free. The event ID is 5157.

 

[torchwood]

Hi Dale,

heres a definition of the 224 0 0 1

A multicast address is a single IP data packet set that represents a network host group. Multicast addresses are available to process datagrams or frames intended to be multicast

in laymans terms - im, or trying, talking to another piece of equipement on your network
SO ITS ALL INTERNAL nothing to worry about
note,
equipement can also mean a program that has been removed, including AV's, but not all the associated interactions have been.

Roy