blocking incoming udp packets

Seems to be a router broadcasting routing information.

Seems to be a network device broadcasting SNMP messages on the local network.

For further information you need to inspect the packets' contents with a protocol analyzer (Wireshark, tcpdump, etc.).

Does your Linksys router have the IP address 192.168.1.1? Unless you need RIP or SNMP on your LAN you should check your router's configuration.

cu

Is UPnP enabled in the router? Try disabling it or check that it is disabled.

I will try to investigate the packets as you suggest.

Thanks.

Jack

Yes, UPnP is disabled in the router. I appreciate your help. Still not getting a grasp of the overall situation.

Jack

I'm wondering in "2008/07/08, 05:40:15.921, GMT -0400, 2010, Device 3" as to what is "device 3". Might it be whatever is plugged into the port numbered 3 on the router? If so, is that your host or another one? If another one, try yanking the cable out of port #3 on the router to see if it all quiets down.

Hello VanguardLH,

The firewall (Deerfield Visnetic) recognizes and lists four devices or "adapters". #1 is labeled \\DEVICE\\NDISWANBH (? a WAN miniport) # 2 is labeled Dialup Adapter #3 is labeled Local Area Connection #4 is labeled Local Area Connection

(#3 and #4 correspond to two LAN connections on the motherboard, which correspond to two networking adapters seen in Device Manager. Only the one corresponding to Local Area Connection #3 on the firewall is being used.)

I have configured the firewall to block everything on adapters #1 and #2 and #4.

The one I use is Device #3, LAN.

Returning to the original question, a summary, as I see it (not necessarily correctly):

It seems the router is sending udp packets to 255.255.255.255 (both source and destination ports = 520, or to 192.168.1.255 (source port ranging from 7000 to 7259, and destination port 162.

I have no idea what this all means.

Again, I appreciate your help.

Jack

JClark wrote: ...

Ansgar already explained, but since you wrote

I will repaeat one more time, and I will provide some links to additional informations.

That is broadcast[1]

UDP 520 is a port used by Routing Information Protocol (RIP) [2] and [3].

UDP 162 is a port used by Simple Network Management Protocol (SNMP) [4] and [5]

IMO everything is OK. But to be sure follow Ansgar advice and inspect packet content, you can use, for example, Wireshark[6].

perhaps become better informed. I may also post something in the Linksys forum (presuming there is one) to see if I have the router configured correctly. Again, thanks.

Jack

Oops, my bad. I thought the "log" was from the router's firewall, not from your software firewall on your intranet host. Have you checked your router's logs? Did you enable logging in the router? Sometimes the router's logs are not so easy to read plus it might be limited in the number of records retained. WallWatcher works with some routers to extract their logs so you can review them locally.

UDP 162 is the SNMP trap port. If you're not familiar with simple network management protocol, this traffic to 162 may simply be the network device attempting to send traps to be logged by an SNMP management station.

UDP 520 is RIP routing. The router is advertising routes with this exceedingly simple, easy to spoof protocol.

Both should be functionality that can be disabled in the source network device.

Best Regards,

Sounds like good advice. I'll work on the Linksys setup with their web-based configuration program. I'm still not understanding it all in depth, but your comments and the earlier replies have given me a good base to work with. Thank you.

Jack

Nothing unusual in the router logs. Thanks for suggestion.

Jack

Todd, Some good news. I was able to disable RIP routing in the router, and now all the traffic over UDP 520 has stopped. Now I need to work on the SNMP 162. It isn't quite as clear. But it seems I'm on the right track. Many thanks again.

Jack

Disabling SNMP in general on the device is a good idea if you're not using it. Did I miss in this thread where the make/model of the router was mentioned?

Hi Todd,

It's a Linksys BEFSX41. The RIP disabling was easy to do, and that has stopped the traffic on port 520. Under "Administration" I have SNMP "disable" checked, so SNMP ought to be disabled. I also have UPnP disabled.

But I'm still getting the port 162 traffic.

Thanks again.

Jack

Barring an answer from an owner here, your next step is to a linksys support forum on this model and asking users there how to disable the sending of traps.

You will also want to make sure you have the latest firmware for that device as it has quite a checkered history with respect to exploitable firmware vulnerabilities.

Best Regards,

Todd,

You and the other reply posters have been very helpful. I'm getting a better understanding of the process. I'll try to follow through with suggestions, including posting in the Linksys forum and updating the firmware.

One last question: Could you recommend a replacement for the Linksys router ("checkered history")? Or even a hardware firewall/router? I know there would be some new learning involved.

Again, many thanks

Jack

I'm a fan of the third party firmware projects out there like dd-wrt and tomato.

Check the hardware compatability matrix for these firmware projects--your Linksys could get a new lease on life perhaps just by blowing away the factory firmware and replacing it with one of these free open source projects.

Otherwise, a Linksys WRT54GL from newegg.com lets you play nicely with these.

Your post was copied and will work on it. Thanks for the umpteenth time!

Jack