Incoming Connection Attempts from Google Are Being Blocked

[yesterdave]

My Security Report in LiveSafe shows that I've had a slew of "potentially malicious incoming connections blocked".  Total 106,764 attempts.

The Security History for the past 24 hours, shows repeated incoming attempts from a recurring set of IP addresses, see attached snapshot.

A lookup of these IP addresses on IPinfo.io shows that most of them belong to Google, and one to Akamai.

Obviously, Google is 'reaching out' to my laptop for an unknown purpose, and the McAfee firewall is blocking it.

My questions about this behavior are:

1. Are these incoming connection attempts from Google a common and recurring event for other LiveSafe users?

2. Does support for McAfee Firewall know for what application these connection attempts are being made?

3. What would be the appropriate NetGuard adjustments needed to allow an incoming connection from Google to occur safely?

Thanks for any light you can shed on this issue.

[exbrit]

1. Yes, we all see those.

2. I would imagine they are well aware of them,  but you'd have to ask support. it's free of charge:  Technical Support

3.  Those are for your information only to demonstrate your firewall is working, and why would you want to let them in as they are most likely aimed at gaining  personal information or your surfing habits?

I would again ask Support about that.

[catdaddy]

Moved from LiveSafe to Personal Firewall > Discussions

[yesterdave]

Even though I have plenty of these "Suspicious incoming network connection blocked" messages, I don't have any IP address logged in NetGuard section of the Firewall settings. NetGuard IS turned on.

These "suspicious incoming network" messages logged in Security History seem to becoming from the personal firewall, but I don't see how I could make modifications to allow their access, without an initial entry in NetGuard.

I disagree, Peter, that these connections from Google are "aimed at gaining personal information".

I use many Google applications via the browser, such as Gmail, Google Drive, Google Maps, and Google Calendar.

It is more likely that these incoming connections are for some type of data update, like a Calendar notification, or a software update, like Google Chrome.

Tech Support was no help at all. I got a front-line chat responder in India, who thought the messages might be coming from the Home Network component of LiveSafe.

Perhaps now that CatDaddy has moved my question to the Personal Firewall forum, I might get some useful responses about how to analyze these blocked connection requests from Google.

[catdaddy]

If I may ask...Could you kindly provide the (Service Request Number) in which you were given after your Support session?  I can ask a couple of our internal Tier 2.5 Technicians/Engineers to look through your session, and possibly could add to the discussion.

sanjay  ​  Could you kindly chime in and add to this discussion?

Thanks

CD

[exbrit]

yesterdave wrote:
Even though I have plenty of these "Suspicious incoming network connection blocked" messages, I don't have any IP address logged in NetGuard section of the Firewall settings. NetGuard IS turned on.
These "suspicious incoming network" messages logged in Security History seem to becoming from the personal firewall, but I don't see how I could make modifications to allow their access, without an initial entry in NetGuard.
I disagree, Peter, that these connections from Google are "aimed at gaining personal information".
I use many Google applications via the browser, such as Gmail, Google Drive, Google Maps, and Google Calendar.
It is more likely that these incoming connections are for some type of data update, like a Calendar notification, or a software update, like Google Chrome.
Tech Support was no help at all. I got a front-line chat responder in India, who thought the messages might be coming from the Home Network component of LiveSafe.
Perhaps now that CatDaddy has moved my question to the Personal Firewall forum, I might get some useful responses about how to analyze these blocked connection requests from Google.

Sorry if my answers aren't sufficient.  This isn't support, it's peer-to-peer conversation, but as I've been using the software for so long I was merely offering my observations from past posts on a similar subject matter.  Those blocked items are more often than not items that are using unconventional ports or simply the wrong conventions to be admitted.   I thought you'd be thankful that the firewall is working so well.  Never mind, someone else will hopefully add to this conversation.

The ability to alter them or admit them was taken away in a fairly recent software update as too many people were fouling up their systems & then asking support to sort the mess out.

[yesterdave]

Hi CD,

Here was my Service Request:

Service Request #: 2184541459

It might be good to get some service techs involved.

I could try contacting Google myself, and ask why they would be initiating a connection from 216.58.193.206 to my laptop, over and over again. But I suspect I'd be quickly brushed aside.

But if Intel Security Tech Support were to ask that question, then the Google Network Techs might cooperate more fully.

- - - - - -

Peter M,

I'm not trying to pick a fight, I am glad to have this Personal Firewall. I think it's one of the best features of LiveSafe.

But that doesn't mean I just shrug my shoulders when I see in the Security Report that I've had 106,764 "potentially malicious incoming network connection blocked". I kinda want to know WHY, or what's going on?

If it's true, as you say that "we all see those" [ 'incoming connection blocked' messages from Google IP addresses],

then shouldn't there be a readily available explanation, if it is so prevalent?

I'm new here. This is my first question in these forums.

I'm just learning about all the features of the Firewall.

I hope it's not a crime to be curious in a product forum.

[exbrit]

Well as an ex-Moderator here I can tell you, that's all they told us, but maybe CD can conjure up some more information - he's asked the resident techs to view the thread.

[catdaddy]

(Peter said)

                       "Those blocked items are more often than not items that are using unconventional ports or simply the wrong conventions to be admitted"

                          Actually I am inclined to agree with Ex_Brit, for we indeed have always been informed as he stated. I cannot conjour up anything either, as I myself am showing  258,367 blocked connections since 10/17/2016.

                          Hopefully Selvan or Sanjay can add to the discussion.

[sanjay · Accepted solution]

1. McAfee firewall blocks various incoming malicious or unwanted packets.

2. This may depend on the source of the packets or their content, but also their timing – which is important in this case.

3. The reason for blocking is not always obvious. It does not implicate that the packet contents or source were malicious, but it is important to block packets that arrive outside the proper time window, so that the computer is adequately protected from attacks such as man-in-the-middle.

4. McAfee is not claiming that sources and their packets involved are malicious, just that the timing could potentially be so, therefore they are blocked.

Cheers

Sanjay