Help with understanding log entry

Have a question or want to start a discussion? Post it! No Registration Necessary.  Now with pictures!

Threaded View


Hello Group,
I have a Linksys router and a Windows XP SP3 computer. My software
firewall is Deerfield Visnetic. Lately I notice log entries when I
boot up (and continuing) which seem to suggest that the router is
trying to send the computer a UDP packet.

Log:
Blocked incoming UDP packet from 192.168.1.1 to 192.168.xxx
source port varies anywhere from 9555 to 9599
destination port is 162

What does this mean?
Should I write a rule to permit it?

Many thanks for any clarification.

Jack

Re: Help with understanding log entry


On Sun, 29 Aug 2010 05:50:26 -0400, JClark wrote:

Quoted text here. Click to load it

If everything is working, why allow it.  :(

Check bottom of page at https://secure.dshield.org/port.html?port=162

Re: Help with understanding log entry


On Sun, 29 Aug 2010 10:00:36 +0000 (UTC), Bit Twister

Quoted text here. Click to load it
Well, I guess you have a point. But I am trying to understand what is
happening and hoped I could learn something.

Jack

Re: Help with understanding log entry


On Sun, 29 Aug 2010 10:00:36 +0000 (UTC), Bit Twister

Quoted text here. Click to load it
Sorry, I didn't see the link at the end of your post. I'll check that
out. And thanks.

Jack

Re: Help with understanding log entry


First off, how can you just "write a rule to permit it" if you do not
understand what it is?
Your router is sending SNMP traps. Go to its setup and disable it. If
you plan on using SNMP monitoring, then configure a specific IP address,
not the entire subnet.


On 8/29/2010 5:50 AM, JClark wrote:
Quoted text here. Click to load it



Re: Help with understanding log entry


iggster wrote:

Quoted text here. Click to load it

Linksys has lots of models.  Not a clue which one the OP happens to use.

Quoted text here. Click to load it


You sure the traffic isn't due to UPnP discovery by the router?  The OP
should see if the traffic stops if UPnP is disabled in the router's
configuration.

http://msdn.microsoft.com/en-us/library/ms885488.aspx
http://en.wikipedia.org/wiki/Upnp#Discovery


Another user spamming in a non-signature on behalf of their NSP.

Re: Help with understanding log entry


On 8/29/2010 10:13 PM, VanguardLH wrote:
Quoted text here. Click to load it
You are correct. I over-estimated the capabilities of Linksys. It most
likely IS the discovery bcast.

Quoted text here. Click to load it
Huh? Spamming?


Re: Help with understanding log entry


iggster wrote:

VanguardLH wrote:
Quoted text here. Click to load it

They are appending their promotional (spam) text onto your posts.  That
spam isn not in a signature (there is no sigdash line).  That means all
of your posts through them are spam.  You have elected to be their
spamming affiliate.

Re: Help with understanding log entry


On 8/31/2010 4:46 AM, VanguardLH wrote:
Quoted text here. Click to load it
This is the news server I use. _One_ line at the end of my posting is
not really offensive, now is it really? I "have elected" to use one of
not so many free news servers. Why this is such a big deal to you that
you "have elected" to waste my time and yours on this discussion that
has nothing to do with the OP? Casual flaming is very easy but most
times it is just a meaningless, well, flaming.
Regards,



Re: Help with understanding log entry


Quoted text here. Click to load it

Because unsolicited advertisements, like those your news provider
appends to each of your postings, are commonly known as "spam". Which is
frowned upon in most any part of Internet and Usenet I had to do with.

Of course the decision whether you want to support spam is entirely up
to you.

Score adjusted. F'up2p.

cu
59cobalt
--
"If a software developer ever believes a rootkit is a necessary part of
their architecture they should go back and re-architect their solution."
--Mark Russinovich

Re: Help with understanding log entry



Quoted text here. Click to load it
Sorry. It's a BSFX41.

Jack

Re: Help with understanding log entry


JClark wrote:

Quoted text here. Click to load it

You sure?  

I went to http://homesupport.cisco.com/en-us/wireless/linksys/ (to see
if they have an online copy of the manual) and a search on "BSFX41"
found no matches.

The manual should describe how to configure the router's behaviors.
They list even my ancient BEFSR41 router there.  Of course, if you have
the manual you could read it to see if the UPnP option is described.
You could just connect to the router's web server (perhaps at
http://192.168.1.1 ) to go look through its configuration screens to see
if there is a UPnP option.  If you find one, disable it to see if the
mysterious traffic ceases.

Re: Help with understanding log entry


wrote:

Quoted text here. Click to load it
Thank you. That does help to explain it. I must now research the
details of the subject you have introduced me to.

Jack

Site Timeline