Why is a McAfee server making unsolicited connections to my PC

[townman]

Whilst reviewing the security history of my All Access - Total protection firewall, I noticed that unsolicited connections from McAfee servers to my PC had been blocked

"The PC 161.69.12.13 tried to connect to TCP port 60962 on your PC without your permission".

#Microsoft Windows [Version 6.1.7601]
#16/06/2014-12:00:57.14
C:\Users\Kevin>ping -a 161.69.12.13

Pinging us.mcafee.com [161.69.12.13] with 32 bytes of data:
Reply from 161.69.12.13: bytes=32 time=178ms TTL=240

I can find no recognised use of port 60962

Why is this connection being attempted and what are the consequences of the connection being blocked?  One supposes that there must a be legitmant purpose for the appempted connection and therefore that it being blocked must be detrimental to the user experience.

Whilst the answer might be "not an issue" something is clearly not right - either the connection has a purpose and therefore should not be blocked, or it has no purpose and should not have been attempted in the irst place.

[exbrit]

Unless a technician sees this and happens to know the answer that sort of question is best dealt with by Technical Support, they are free to contact by phone or online chat and linked under Useful Links at the top of this page.

I would imagine it's just handshaking between your machine and the update servers but that is only a guess.

[Hayton]

Two issues here. One, why is a McAfee server trying to connect to your PC; and two, why is it using this high port number (and what is the significance of that particular port)?

The port number is fairly easy to deal with so I'll do that first. Port 60962 is a randomly-selected high port number in the range of ports which are classed as 'dynamic' or 'ephemeral'. The port number by itself has no significance.

http://68.67.73.20/port.php?port=60962&print=friendly  (Speedguide.net)

https://en.wikipedia.org/wiki/Ephemeral_port

An ephemeral port is a short-lived transport protocol port for Internet Protocol (IP) communications allocated automatically from a predefined range by the IP software. It is used by the Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or the Stream Control Transmission Protocol (SCTP) as the port assignment for the client end of a client–server communication to a well known port on a server.

As to why that connection was attempted, I cannot say. Your PC is in constant touch with McAfee servers (and vice-versa) while it's switched on, and that IP address you mention (161.69.12.13) maps to the domain name "us.mcafee.com" : a server in Santa Clara, California. Since I installed tcpview (from Microsoft Sysinternals) I have had fun watching the myriad connections that take place during the startup process, and connections to "us.mcafee.com" are set up and closed repeatedly. This is normal ... but I can only guess as to what each connection is doing. Checking to see if an update is needed, actually updating files (spam definitions, for example) - that's possible. One thing I can say is that the connection to "us.mcafee.com" is made by McSvHost and is distinct from the connection that mcshield makes to McAfee, which is to "cloud.gti.mcafee.com", and so is probably to do with McAfee software components.

[townman]

Hayton,

Thank you for the informative reply.

All that said, without knowing why this sequence of events is taking place - which McAfee firewall acts to inhibit - one is not able to discen the consequential deficiency in the correct operation of the product.

Regards.

[Hayton]

In your original post you said

either the connection has a purpose and therefore should not be blocked, or it has no purpose and should not have been attempted in the irst place.

So yes, the connection has a purpose, and it's coming from a known server, and so should be allowed. The question then is how to allow connections from McAfee servers. If you open Security Center and select the firewall settings, there are two places where this might be done : in 'Internet Connections for Programs' and in My Network Connections.

First, in Internet Connections for Programs find and click on McAfee Service Host; set its permissions to Full. You can probably safely disable NetGuard as well.

In My Network Connections add a rule for the IP address so the firewall won't block any connections. From the online Help :

You can configure Personal Firewall to manage specific remote connections to your PC. 
You manage PC connections by creating rules based on the Internet Protocol (IP) addresses of specific remote PCs. PCs that are associated with Home IP addresses are allowed to connect to your PC
Home 
Allows traffic from an IP address to reach your PC through any port. Activity between the PC associated with a Home IP address and your PC is not filtered or analyzed by Personal Firewall. By default, the first private network that Personal Firewall finds is listed as Home in the My Network Connections list. 
Work 
Controls traffic from an IP address when it connects to your PC, and allows or blocks that traffic according to the rules in the Ports and System Services list. Personal Firewall logs traffic and generates event alerts from IP addresses with this level of trust. 
Click My Network Connections. 
Under Add Network Connection, select the version of the PC's IP address: IPv4 or IPv6. 
Do one of the following: 
Select Single, then type the IP Address. 
Select Range, then fill in the appropriate fields. 
 
If a system service uses Internet Connection Sharing (ICS), you can type 192.168.0.1 to 192.168.0.255 for the starting (From:) and ending (To:) IP addresses. 
From the Network Type menu, specify the network type for this PC connection. 
(Optional) Under Days Before Expiration, type the number of days the rule is enforced before it expires. 
Type an optional description for the rule. 
Click Save. 

McAfee controls not just that one address but all of them in the range from 161.69.0.0 - 161.69.255.255, so you could if you want allow all addresses from that range to have access to your PC.