Can SBIE tell me IP addresses being accessed when blocked?

[stisev]

Hi tzuk,

I realize you want to keep SBIE efficient and light, but I find that when SBIE triggers an 'Program xxx has accessed the net but blocked' I want to know WHAT address (IP + hostname) it accessed in a list that shows in the same box.

Is this feasible? Would people find this useful?

[tzuk]

No, you need a firewall for that. Sandboxie is not a firewall and the Internet access restriction occurs when the program tries to generally initialize Internet functionality, which means before the program asks for any specific Internet operation, and before it gives any specific IP address.

[stisev]

No, you need a firewall for that. Sandboxie is not a firewall and the Internet access restriction occurs when the program tries to generally initialize Internet functionality, which means before the program asks for any specific Internet operation, and before it gives any specific IP address.

AH, ok, got it.

tzuk,
May I ask then if there is a way to find out with another program. I was thinking along the lines of CurrPorts.
http://www.nirsoft.net/utils/cports.html

Would that work you think? I am asking because I am thinking if the program is blocked from initializing Internet functionality like you mentioned, then it cannot even access the net to figure out which IP it is accessing.


Also, when you mention that I need a firewall for what:
1) Any general recommendations for a lightweight firewall you know of?
2) Can or MUST the firewall be in the sandbox in question (e.g. ISOLATION sandbox)?. Does ZoneAlarm, for example, have to be in or out of the sandbox for detection to work?

[Buster]

May I ask then if there is a way to find out with another program. I was thinking along the lines of CurrPorts.

Would that work you think? I am asking because I am thinking if the program is blocked from initializing Internet functionality like you mentioned, then it cannot even access the net to figure out which IP it is accessing.

You must allow internet connections and let the firewall block/log the connections.

As you say, if Sandboxie blocks the internet connection, the firewall will not have even a chance to do the work.