This is an oddity I have noticed in the firewall logs.
For some time now Windows Update gets blocked by the SEP12 firewall, so I have added rules to the firewall to allow those Host IP addresses permission. This is a bit tedious at times but works, clear the log, activate winupdate, look at log, if a Microsoft update URL is blocked, add a rule for those IPs and with a bit of extra space 1-255 on the ip range. This seems to work, and I am not letting in the whole world.
Then I noticed an oddity; my computer IP was listed as the remote host, and an IP for 157.56.107.154 was listed as Local Host, the connection was blocked. I did a whois on the address and it seems to be one owned by Microsoft corporation, hmm... OK, but it was listed as inbound, so it was actually outbound from my computer to a MS host: the local MAC most definitly not on my computer (A0-21-B7-73-1D-64), I checked with ipconfig /all, nope not mine. The User listed was SYSTEM, and the busy application was c:\windows\system32\svchost.exe, but I don't know what service program called svchost to make this connection. So Is this normal and if so could someone please explain, I'm just a bit boggled by this one.