Re: Denied UDP packet from LAN port 4654 to router 1900
From: wailakig (wailaki@batnet.com)
Date: 12/05/02
- Next message: chris: "windows critical update fail"
- Previous message: Don Rouse: "disable downloading"
- In reply to: Karl Levinson [x y] mvp: "Re: Denied UDP packet from LAN port 4654 to router 1900"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: wailaki@batnet.com (wailakig) Date: 4 Dec 2002 15:42:52 -0800
These log entries won't show in the SonicWALL log if you turn off the
Log Category called 'Denied LAN IP' on the Log Settings screen. And
it's definitely the XP-style messenging UPnP stuff causing 1900 UDP
logging.
"Karl Levinson [x y] mvp" <levinson_k@excite.com> wrote in message news:<Op5p9Z0mCHA.2228@TK2MSFTNGP12>...
> I hate that too.
>
> Probably MSN Messenger which I think enables or uses Universal Plug and Play
> to try to [I think] enumerate network devices. I believe you can disable
> the SSDP and/or UPnP
> service(s) and reboot, and/or there's a utility at www.grc.com to disable
> UPnP, and if the packets continue after that, I think you might also need to
> uninstall or disable MSN Messenger from loading automatically with Windows.
> I seem to remember having to do multiple things on one XP machine to finally
> stop those packets.
>
> http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=udp+1900+universal
> http://www.google.com/search?hl=en&ie=ISO-8859-1&q=udp+1900p://is-it-true.org/nt/xp/registry/rtips18.shtml
> http://is-it-true.org/nt/xp/registry/rtips18.shtml
>
>
> "Gregg" <bogus@nowhere.com> wrote in message
> news:exP4cfymCHA.1624@TK2MSFTNGP10...
> > Hello!
> >
> > I have a 3Com Office Connect firewall (same as SonicWall) that keeps
> getting
> > hundreds of log entries for "12/03/2002 15:37:30.064 Denied UDP packet
> from
> > LAN 10.0.0.124, 4654, LAN 10.0.0.1, 1900, LAN."
> >
> > They all come from the same Windows XP Professional computer on port 4654
> > and are destined for port 1900 on 10.0.0.1, which is the firewall's IP
> > address. We have several XP Pro computers, but only this one shows these
> > entries. I ran FPORT and it showed the "System" process ID 0 as the only
> > thing on those ports and gave no further detail (no program shows on those
> > ports).
> >
> > Does anyone have an idea what could be causing these probes? Norton AV
> > Corporate shows no virus activity.
> >
> > Our domain is an NT4 domain.
> >
> > Gregg Hill
> >
> >
- Next message: chris: "windows critical update fail"
- Previous message: Don Rouse: "disable downloading"
- In reply to: Karl Levinson [x y] mvp: "Re: Denied UDP packet from LAN port 4654 to router 1900"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
