100's of logged events The Windows filtering Platform has blocked a packet (5152) it appears that Sophos end point security is causing out log files to fill up with this error and may be generating unnecessary network traffic. Anybody find a solution?

Hello Joseph Kuhn,

Are you using Sophos Central or Endpoint Sec and Control  ? (Your link is for Central, so I am trying to determine what version you are using).

Also, could you please provide the full information of event that you are seeing, and let us know whether the steps listed in the thread you provided work for you? 

Regards,

End point security, and Intercept X are installed on the server and all workstations. They are up to date with the current versions of the products. We have been on the phone with Sophos support today.

Not sure what Sophos 2nd level support did, but the problem magically disappeared the audit 5152 records have stopped, and the network traffic seems better as the workstations are preforming better again. 

We were told to notify Sophos if the problem re-appears?

Hello Joseph Kuhn,

If you would like to DM me the ticket number, I will have a look and update this thread. 

Regards,

I'm having the same issue with Sophos EndPoint and my security audit, is there a fix?

thanks

Hello joeyl ,

If the steps I provided on my previous response do not work for you, please file a case with Support for further assistance.
If you already have a case, please send me a DM with your ticket number so that we can follow-up.

Regards,

thanks, I have filed a case with support

I have started seeing this issue on my servers since I updated to Sophos Central. I opened up ticket with Sophos and they told me I had a virus on my network. I do not think  I have a virus on the network causing the issue. I do not necessarily want to disable the logging. Any other suggestions?