> Source: [sk163497](https://support.checkpoint.com/results/sk/sk163497)

# sk163497 - When WSL (Windows Subsystem for Linux) enabled on Windows 10 and user runs command from terminal that initiates network traffic, traffic is blocked

| Property | Value |
|----------|-------|
| Solution ID | sk163497 |
| Date Created | 2019-11-11 |
| Last Modified | 2020-10-11 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |

## Symptoms

- When WSL(Windows Subsystem for Linux) is enabled on Windows 10, and user runs command from terminal that initiates network traffic, the traffic is blocked:  

```
$ ping 8.8.8.8 -c4
    PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

    --- 8.8.8.8 ping statistics ---
    4 packets transmitted, 0 received, 100% packet loss, time 3023ms

tvdebug.log output:
(86700858 p:e2c t:1388 2019-11-07 11:28:16) [SOCK] Socket icmp_connect blocked: result=10000000 process= (pid=1fc4) ip=8.8.8.8 port=0
(86701858 p:e2c t:1388 2019-11-07 11:28:17) [SOCK] Socket icmp_connect blocked: result=10000000 process= (pid=1fc4) ip=dns.google port=0
(86702874 p:e2c t:1388 2019-11-07 11:28:18) [SOCK] Socket icmp_connect blocked: result=10000000 process= (pid=1fc4) ip=dns.google port=0
(86703889 p:e2c t:1388 2019-11-07 11:28:19) [SOCK] Socket icmp_connect blocked: result=10000000 process= (pid=1fc4) ip=dns.google port=0
```

## Cause

The WSL process is a Pico process. Pico processes have no PEB (Process Environment Block).

Due to lack of PEB, the "Self Protection" module assigns this process to the default group, and this results in blocked traffic for this process.

## Solution

**Note**   

* **Fix is targeted to WSL(1). WSL2 is not officially supported.**
* The feature is disabled by default.

**To enable the WSL feature, follow the instructions below:**

1. On your PC, create the *DummyWSL.xml* file, with the following content:  

   \<?xml version="1.0" encoding="utf-8"?\>  
   \<scan\>  
   \<system_info\>  
   \<property name="AppscanVer" value="3.0.0.1"/\>  
   \<property name="OSName" value=""/\>  
   \<property name="OSVersion" value="6.2.9200 "/\>  
   \<property name="OSLang" value="1033"/\>  
   \<property name="UserDefLang" value="1033"/\>  
   \<property name="OSLangName" value="ENU"/\>  
   \<property name="OSCountryName" value="USA"/\>   
   \<property name="UserLangName" value="ENU"/\>  
   \<property name="UserCountryName" value="USA"/\>  
   \</system_info\>  
   \<file\>  
   \<property name="path" value="C:\\Windows\\SysWOW64\\Zonelabs\\DummyWSL.exe"/\>  
   \<property name="CompanyName" value="Check Point"/\>   
   \<property name="FileDescription" value="DummyWSL"/\>   
   \<property name="FileVersion" value="1.0.0.1"/\>   
   \<property name="InternalName" value="DummyWSL.exe"/\>   
   \<property name="Language" value="English (United States)"/\>   
   \<property name="Lang" value="en-US"/\>   
   \<property name="LegalCopyright" value="Copyright (C) 2019"/\>   
   \<property name="OriginalFilename" value="DummyWSL.exe"/\>   
   \<property name="ProductName" value="End Point Security"/\>   
   \<property name="ProductVersion" value="1.0.0.1"/\>   
   \<property name="FileCreationTime" value="2019-10-08 14:40:19 +02:00"/\>   
   \<property name="FileSize" value="18712"/\>  
   \<property name="MachineType" value="Unknown"/\>  
   \<property name="MD5ChecksumHex" value="c5e724d6-70390e45-8b74dc7c-dd779cb6"/\>   
   \<property name="SkimpChecksumHex" value="7c20c402-174c634d-2a21133e-b77726a5"/\>   
   \<property name="signer" value="Check Point Software Technologies Ltd."/\>   
   \<property name="signerPKHash" value="b3f2bcb8418e9de30ee51d6f9717734d640ef5ff"/\>   
   \<property name="root" value="VeriSign Class 3 Public Primary Certification Authority - G5"/\>   
   \<property name="rootPKHash" value="b181081a19a4c0941ffae89528c124c99b34acc7"/\>  
   \</file\>  
   \</scan\>  

2. Open "Check Point SmartEndpoint" \> "Policy" tab.
3. In the "Application Control" rule, in the "Actions" column, right-click on "Allow Unidentified Applications".
4. Click on "Import Programs".
5. Browse to "*DummyWSL.xml*" and click "Import".
6. After a successful import, right-click on "Whitelisted Applications".
7. In the "Actions" column, click on "Manage Allowed Apps List".
8. Click on the "Add Application to Allow List" button.
9. In the Search field, type "DummyWSL".
10. Select raw with it and click "Add".
11. Click "Ok".
12. Install policy.
13. After about a minute, the policy will be updated on the client. Then, check that in *tvDebug.log* there exists a log with:  
    *\[XMLRPC\] DIO constructor: DeviceIoControl(DIOC_DRIVERCTRL,DRVIO_SET_WSL,**TRUE**). result=1*

**To disable the WSL feature:**

1. Right-click on "Blacklisted Applications".
2. In the "Actions" column, click on "Manage Blocked Apps List".
3. Click on the "Add Application to Block List" button.
4. In the Search field, type "DummyWSL"
5. Select raw with it and click "Add".
6. Click "Ok".
7. Install policy.
8. After about a minute, the policy will be updated on the client. Then check that in the *tvDebug.log,* there exists a log with:  
   *\[XMLRPC\] DIO constructor: DeviceIoControl(DIOC_DRIVERCTRL,DRVIO_SET_WSL,**FALSE**). result=1*

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content