I usually see lots of entries for In Block  Remote Administration is my event log. Typically I will see 4/8 entries an hour throughout the day and night. I have read these are just the usual probing that occurs on the web and the log shows these are being blocked by the firewall - which is reassuring.
However, after some restarts I won't see any Remote Administration events in the log until the next restart (which might be 14 days away). The firewall is still showing as being on during this time.
My question is why do I go from seeing pages of these entries (which I understand is normal) to none after some restarts?
Does it mean the firewall is not working properly and letting these probes through sometimes?
Would be grateful for any reassurance.
After every restart, your IP address changes. It may be that some addresses are known to the hackers, who are constantly probing them, while some aren't.
Sorry to raise this concern again ,but I just noticed that again that the 'blocked remote administration' entries have disappeared from my event log for over a week now (following a restart).
Whilst I understand that some IP address are less susceptible to being probed - it is really feasible that some IP address range are never probed? The IP address is just the standard BT allocated range. Is this likely?
Whilst it may sound odd, I quite like the positive assurance that remote access attempts are being blocked and when I stopped seeing these entries in the log its a little unsettling. (and i begin to wonder whether the hub firewall is still working).
Thanks, I'll try that later.
Will it show whether unauthorised attempts (like remote administration) are being blocked, as I've seen they commonly relate to ports 22, 80 and 443.
It will test to see if ports are open. It will not show if attempts have been made to access them. That can only be done from the router.
They should show as Stealth. Unless some application currently is listening on the port(s), in which case it may show either open or closed.