Lately I've been getting hit by these "Inbound TCP connections" literally every few seconds.
"Rule "Default Block SSDP" blocked 192.xxx.xx.x Inbound TCP Connection"
I have checked my security history and I estimate that there is about 400+ of these messages throughout the course of 4 hours.
I have never experienced this before, and I do not know what this means or what it could mean to the security of my computer.
What does this mean? Can anyone explain it? Is this a virus or an attacker trying to gain access to my computer?
Hi I_Kill_Viruses,
This is nothing to be concerned about. Simple Service Discovery Protocol, along with Universal Plug n Play, is used by devices on a Local Area Network to find each other. What you are seeing is a multicast "shout-out" by something on your network that is announcing its presence. When you have Windows FIle and Printer Sharing enabled, Norton will allow this traffic in order to facilitate communication between your computer and other devices on the network. If you have sharing turned off, Norton blocks the traffic because it is not needed. So what you are seeing is a device on your network (IP addresses in the 192.168.x.x range cannot be routed on the internet) letting other devices know it is there, and Norton blocking this traffic from entering your computer. One likely source of the traffic is your router. You can go into the router configuration settings and disable UPnP, and that might put an end to the multicasts. Otherwise, simply allowing the Norton Firewall to continue to block the traffic is perfectly fine - you are not being attacked, the traffic is originating on your own network (not the internet) and no harm is being caused.
Setting the SSDP Discovery service to disabled usually fixes it too. It is safe to turn off unless you explicitly need it for something.
Thanks SendofJive, I appreciate the quick response as well as calming my nerves.
+1 Kudos