If you see http://www.msftncsi.com if your firewall logs, it is due to the
Network Connectivity Status Indicator feature in Vista. It typically puts the little "earth" near the network interface icon in the tray bar, like this:
Normally this doesn't cause any problems, but there have been instances when captive portals (the landing pages you go to, to agree to their terms of use, like
WifiDog or
NoCat) will only respond to the first HTTP request from an unknown system. In those cases, I've had to jump through hoops to get online properly. It is a rare case, but I've had it happen at a few hotels.
For those curious, what it is doing is requesting a file from
http://www.msftncsi.com/ncsi.txt and looking for it to return a response of
Microsoft NCSI. If the operating system receives that, it puts the little 'earth' graphic next to the network interface.
You can, thankfully, disable this behavior with a registry setting. If you set
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing to
0, the OS will no longer probe for internet connectivity, but you also lose the pretty 'earth' graphic.
This topic hasn't talked about very much, and I found it interesting after looking at some network traces and finding the Microsoft page related to it. Hopefully people will find this information helpful and/or interesting.