ESET AV Home, the current main version, running on XP, Windows behind a DSL-Router. Traffic monitor (part of Sunbelt Personal Firewall) shows, amongst others, following traffic (first) ekrn.exe sends TCP packet to remote port 80, external IP, local port 1102 (one minute later, however time distance can vary) TCP packet comes in. It comes from the same external IP into the same port as the predecessor outbound packet was sent out. However, traffic monitor indicates this port as unopened. It looks like answer to the predecessor outbound packet. Which circumstance is bad here? a) packets are coming back from the same external IP or b) the local port is unopened, does not accept Or has all this to be interpreted as failure of traffic monitor? One yet observation: ekrn.exe is sending TCP also from second port. Port located very close to the port used in issue described above. Numbers of these two local ports differ by 1. This outbound traffic goes to different external IP (93.184.x.x, for the issue above it was 89.202.x.x). And is repeated after few seconds for three times. However, in this case the traffic monitor does not indicate reply traffic, same traffic parameters but inversed in direction. Where does the difference against previous case can come from?