why does Windows Firewall say Public Networks Connected?

[firewallQ]

Why does it say "Connected" next to "Public Networks" in my Windows Firewall page when in fact my computer does not show it is connected to any network at all? Why is Windows Firewall telling me I am connected but all the other relevant notifications in my computer say that I am not connected?

Am I missing something here?

Even when I disable all my network connections and turn off Windows Firewall, the Windows Firewall page still says I am "Connected".

Any ideas?

(This is on a brand new computer -- just a few days old -- with Windows 7, 64-bit.)

 

[kegobeer]

I don't know why Windows does that, but it is the default behavior. It seems like the default profile is "public" when there is no active connection - probably another layer of protection by default. AFAIK it doesn't hurt anything. I've never run into any issues on the computers that I run without any network connections.

 

[firewallQ]

Thanks but can you please clarify? Ｉdon't mind the default profile being public, but is it supposed to say the network is "CONNECTED"? Why would it say that? Is it within the realm of possibility that a hacker has "installed" a hidden network connection on my computer? (that is, hidden to all Windows components except the Firewall). After all, I had no internet security program running (had to uninstall Norton) at one point when I was connected to the internet for a couple minutes.

 

[severedsolo]

Thanks but can you please clarify? Ｉdon't mind the default profile being public, but is it supposed to say the network is "CONNECTED"? Why would it say that? Is it within the realm of possibility that a hacker has "installed" a hidden network connection on my computer?

Within the realms of possibility? Yes.
Likely? No. Mine says exactly the same thing, and I KNOW I am uninfected, this is a clean install (less than 30 minutes old, MSE on and updated before I connected, only site I have visited is SevenForums.)

As Kegobeer said, this is normal behaviour, if nothing abnormal is happening, then the most likely conclusion is that you are worrying over nothing. Despite what certain security software companies would have you believe *cough norton* infections don't happen the moment you go online unprotected. On top of this, if you have downloaded nothing, and are behind a NAT Firewall (IE you have a router) the chances of someone getting into your system are next to none.

If I were to take an educated guess, I would say that it is the "Loopback Interface" of 127.0.0.1

When Windows needs to "network" with itself, it uses the IP address of 127.0.0.1. This connection is ALWAYS on whether you are online or not. It is completely harmless, as all it does if any program tries to access it is "Loopback" the connection to your machine. My guess would be that this is what Firewall has detected, and is (rightly) protecting.

Edit: just thought I should clarify the above. the CONNECTION is harmless, what a program chooses to do with that connection may not be.

 

[firewallQ]

Well, abnormal stuff did happen on my computer before and after I noticed the firewall issue (but I don't know whether the firewall had always said "CONNECTED" from the very first time I set up my computer and before I connected to the internet --because I had not checked it at that point -- did you?) :

BEFORE I noticed it:

1. Windows Update (using its completely manual mode -- the lowest on the list of its four options) failed and showed error code 8024400A, but my computer's network connections showed it had downloaded about 3 million bytes before the error code popped up, and then after the error code popped up, mysteriously continued to download 1000s of more bytes, even though Windows Update had stopped and I didn't have any webpage open and Norton auto-update was off.

2. After I did system restore to the time of first setup of the computer, Norton's firewall and internet intrusion functions would not allow me to turn them on; every time right after clicking them on, they would always go back to the "off" position.

AFTER I noticed the Windows Firewall issue:

During shutdown, a message popped up for about 10 secs saying something like "the computer is configuring windows" or "windows is configuring the computer" -- I am sure the word "configuring" was there but don't remember the other words exactly-- even though I had not downloaded or installed any program on the computer (I had only disabled bluetooth and maybe also the camera in Device Manager). Is this "configuring" message normal under these circumstances?

Thanks for all your help!

 

[kegobeer]

More likely you already had a virus on your computer that Norton missed. Do you happen to do any file sharing (ie: kazaa, etc)? If you can't enable Norton, then something is on there actively preventing it from happening. If you have the means available, I'd take out that hard drive and slave it into another computer (temporarily) - then scan for viruses. Personally I have no use for Norton - I prefer Microsoft Security Essentials.

As for the configuring message - at least one update was probably downloaded and installed, which resulted in the configuring message. That's happened to me on a computer that has only been connected to the internet for Windows updates (it's a car pc that doesn't usually have internet access, unless I'm at home and I run an ethernet cable to it). I had updates enabled, and as soon as it sensed a connection it started downloading updates. I chose to restart it, and up popped the configuring message.

I have a dev machine that's never been connected to the internet, and it shows the firewall is connected.

 

[firewallQ]

This is a brand new computer -- just had it for a few days -- and I have not done any file sharing or gone to any webpages except for a public Wifi welcome and accept page (in order to access the internet to use Windows Update). My Windows Update was set to not download/install automatically -- all that is done manually.

 

[firewallQ]

And it's not that I wasn't able to "enable" Norton. I did enable it. After first enabling Norton the first time out of the box, all the functions inside Norton were "on" and working, but after I did Windows System Restore after my Windows Update failed, it went back to the only available restore point, which was the very first setup of the computer, and so it asked me to enable Norton again, which I did. Enabling worked again, but instead of the green check mark on the Norton icon in the task bar, there was now a red x mark, and while all the other functions in its settings were on, the Norton "firewall", "internet intrusion", and email protection something functions -- and just these three functions -- were "off" and would not allow me to turn them "on".

 

[firewallQ]

"I have a dev machine that's never been connected to the internet, and it shows the firewall is connected."

Kegobeer, thanks. Can you please specify? Does it say "connected" next to "public networks" or both "private" and "public" networks in your Windows Firewall setting page?

 

[severedsolo]

FirewallQ please use the edit button, it makes life so much simpler when formulating replies to long responses such as yours

Windows Update (using its completely manual mode -- the lowest on the list of its four options) failed and showed error code 8024400A but my computer's network connections showed it had downloaded about 3 million bytes before the error code popped up

If you receive Windows Update error 8024400a, 8024400d, or 8024400e while checking for updates, it might be caused by a connection interruption between your computer and the Windows Update servers. Close Windows Update, wait 10 to 15 minutes, and then run Windows Update again. You can also wait for Windows Automatic Update to run at its next scheduled time.

Source: Windows Update error 8024400a, 8024400d, or 8024400e

By the way, 3,000,000 bytes is about 2.96MB, which if you had a connection error to the server, would probably be about 1 update, hence why you got the "configuring updates" message very briefly, it was sorting out the 1-2 updates it HAD managed to grab. As for the 1,000 or so you saw afterwards, I would expect to see that, because WIndows update would be trying to reconnect to the server.

Is this "configuring" message normal under these circumstances?

If you have been connected to the update server, even for a brief period of time, then yes, perfectly normal. See my above post, cba to repeat myself.

I don't know whether the firewall had always said "CONNECTED" from the very first time I set up my computer and before I connected to the internet --because I had not checked it at that point -- did you?

No, admittedly I didn't. As I said though, my machine had been "live" (that is had Windows installed, for less than 30 minutes at the time of my check. The chances of me being infected, especially considering that my security was ALREADY on and updated (grabbed the update files before I installed) are next to none. Therefore, normal behavior. (and yes, when I checked the firewall settings I was disconnected from the internet)

After I did system restore to the time of first setup of the computer, Norton's firewall and internet intrusion functions would not allow me to turn them on; every time right after clicking them on, they would always go back to the "off" position.

Possibly a virus, possibly Norton being screwy, personally I'd lean towards the latter, but as kegobeer said, does no harm to check.

I have not done any file sharing or gone to any webpages except for a public Wifi welcome and accept page (in order to access the internet to use Windows Update).

For someone so paranoid about security... taking an unprotected machine onto a public hotspot is not exactly a brilliant idea.

Im still willing to bet its Loopback, but I won't completely discount the notion you may have picked something up. All of your symptoms can be explained by other stuff though, just saying.

 

[kegobeer]

"I have a dev machine that's never been connected to the internet, and it shows the firewall is connected."

Kegobeer, thanks. Can you please specify? Does it say "connected" next to "public networks" or both "private" and "public" networks in your Windows Firewall setting page?

When not connected to the internet, under Windows Firewall with Advanced Security, it shows "Public Profile is Active". On a computer that is connected, it shows "Private Profile is Active" (on a private, ie: home, network).

 

[firewallQ]

FirewallQ please use the edit button, it makes life so much simpler when formulating replies to long responses such as yours

Sorry, I don't see any edit button.

You wrote: By the way, 3,000,000 bytes is about 2.96MB, which if you had a connection error to the server, would probably be about 1 update, hence why you got the "configuring updates" message very briefly, it was sorting out the 1-2 updates it HAD managed to grab. As for the 1,000 or so you saw afterwards, I would expect to see that, because WIndows update would be trying to reconnect to the server.

No, the message was NOT "configuring updates", which would have been expected. It was a different message about "configuring" definitely WITHOUT the word "updates". This is why it was so weird and why I asked the question.

UPDATE!!! Another user on the HP User Forum has just told me that his Windows Firewall says "NOT CONNECTED" for "Public Networks". So now what are we to make of this discrepancy?

Also, in this forum, our other user friend (sorry I can't remember your name now) has just told us that his says "ACTIVE" instead of "CONNECTED"; why this difference?

For someone so paranoid about security... taking an unprotected machine onto a public hotspot is not exactly a brilliant idea.

Not ideal but have no choice, because the alternative would be setting everything up in another country (not to be named) where the risks are likely even higher.

You wrote: Im still willing to bet its Loopback, but I won't completely discount the notion you may have picked something up. All of your symptoms can be explained by other stuff though, just saying.

The other forum's user said his Firewall says "NOT CONNECTED" for Public Networks, so I guess it can't be the Loopback. Can someone with the know-how (of contact method and/or connections) help us get an answer from Microsoft?

 

[firewallQ]

Well, using the QUOTE button messed everything up, so please disregard my earlier post, and see this one instead:

You wrote: please use the edit button, it makes life so much simpler when formulating replies to long responses such as yours

Sorry, I don't see any edit button.

You wrote: By the way, 3,000,000 bytes is about 2.96MB, which if you had a connection error to the server, would probably be about 1 update, hence why you got the "configuring updates" message very briefly, it was sorting out the 1-2 updates it HAD managed to grab. As for the 1,000 or so you saw afterwards, I would expect to see that, because WIndows update would be trying to reconnect to the server.

No, the message was NOT "configuring updates", which would have been expected. It was a different message about "configuring" definitely WITHOUT the word "updates". This is why it was so weird and why I asked the question.

Also, can you explain to this novice why you would expect to see more than a 1000 bytes of download (vs. upload) if there was only trying but no actual connection to the server?

UPDATE!!! Another user on the HP User Forum has just told me that his Windows Firewall says "NOT CONNECTED" for "Public Networks". So now we are back to square 1. What are we to make of this discrepancy?

Also, in this forum, our other user friend (sorry I can't remember your name now) has just told us that his says "ACTIVE" instead of "CONNECTED"; why this difference?

You wrote: For someone so paranoid about security... taking an unprotected machine onto a public hotspot is not exactly a brilliant idea.

Not ideal but have no choice, because the alternative would be setting everything up in another country (not to be named) where the risks are likely even higher.

You wrote: Im still willing to bet its Loopback, but I won't completely discount the notion you may have picked something up. All of your symptoms can be explained by other stuff though, just saying.

The user on the other forum said his Firewall says "NOT CONNECTED" for Public Networks, so I guess it can't be the Loopback. Can someone who is able and knows how to get Microsoft support for free help us get an answer from them? Thanks!

 

[severedsolo]

Well you've got me. I have no idea then. I still suspect that it is normal behaviour, but as you said, I can't prove it, and I certainly can't tell you why it's doing it.

In answer to your question, I didn't actually read what you said properly, that was a mistake on that part. I misread it as 1000B of upload. All the same, approx. 1KB of download is not anything to write home about, that would suggest to me to be normal low level internet activity. (My connection very rarely actually hits 0 if there is an active connection, Windows is listening on ports 445 and port 49159 constantly, as well as various other programs such as flash and java periodically listening for updates, whether they were installed at the time I don't know) My apologies for the mistake there.

On Active vs Connected, Just a guess here, but it could be down to language differences or OEM vs Retail versions of 7. Certainly in this context the two are interchangable.

You may be better off posing your connections on Technet's networking section; Windows 7 Networking Forum as frankly, I have no more answers for you. Im as stumped as you are, I'd certainly be interested to know the response though.