Why www.msftncsi.com keeps showing up in firewall logs with Vista and why it can cause problems with internet captive portals and WiFi hot spots

If you see http://www.msftncsi.com if your firewall logs, it is due to the Network Connectivity Status Indicator feature in Vista. It typically puts the little "earth" near the network interface icon in the tray bar, like this:

Normally this doesn't cause any problems, but there have been instances when captive portals (the landing pages you go to, to agree to their terms of use, like WifiDog or NoCat) will only respond to the first HTTP request from an unknown system. In those cases, I've had to jump through hoops to get online properly. It is a rare case, but I've had it happen at a few hotels.

For those curious, what it is doing is requesting a file from http://www.msftncsi.com/ncsi.txt and looking for it to return a response of Microsoft NCSI. If the operating system receives that, it puts the little 'earth' graphic next to the network interface.

You can, thankfully, disable this behavior with a registry setting. If you set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing to 0, the OS will no longer probe for internet connectivity, but you also lose the pretty 'earth' graphic.

This topic hasn't talked about very much, and I found it interesting after looking at some network traces and finding the Microsoft page related to it. Hopefully people will find this information helpful and/or interesting.