What is "default block UPnP discovery"

Norton Security | Norton Internet Security
1

Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.

2

Hi all

JUst asking what this means its in my recent history the above followed by stealthed(xxxxx,portSSdp(1900)

in bound UDP packet

local address "don't know if I should put it here" port SSdp(1900)

remote address service(I think this is mine,port 49153)

process name is C:\windows\system32\svchost.exe

NIS2009 says its low risk,I'm not worried but would like to know if this is what you mean by someone trying to break into my PC(dumb queston to some but important to me)

for what its worth I looked in my internet history and in amongst Norton community which was where I was there was a lone farm4.static.flicker.com?about the same time as the above was happening.am I adding 2+2 and coming up 5.this has happened once or twice.

Cheers Mo

3

In XP, the Simple Service Discovery Protocol (SSDP) discovery service searches for Universal Plug and Play devices on your home network. SSDP searches for upstream Internet gateways using UDP port 1900 This is Universal Plug and Play Network Address Translation (NAT).

 

This is also used by MSN Messenger. So does Google toolbar is some way.

 

Quads 

1 Like
4

Most Security software default blocks ports 1900 and 5000 due to the vulnerability to some Trojans.

 

Quads 

5

Hi Quads

Thanks for your answer,Plug and play is that for games?others on my PC play a lot of the free online game sites not using any other devices which I assume is playstation controllers etc.MSN is turned off as far as I know,I recall in NIS2008 there was a log where MSN was trying to connect to the same IP I looked it up in ARIN and it was a windows messenger broadcast to Mcast net?Should there be away of stopping this?I hope I'm explaining this well.So its basically coming from my PC looking to hook up with something outside?

Cheers Mo

6

Mo

 

 

Basically if you want (or someone) wants to connect to media servers (Mcast), or your own media server like Twonky.   Google Twonky Vision for an idea.   There is a way to stop MSN via the registry, By changing the UPnP Mode

 

I wouldn't worry about it.

 

Plug and Play generally refers to that act of being able to connect a device to the PC  without you having to install drivers or configure the device to the PC,  Like like connecting this to the USB or Mice etc.

 

Quads 

 

 

 

 

7

Hi again Quads

In my event logs in windows this is in the system log when I have logged on is this what you are talking about being blocked

A port was listed as  an exception when windows firewall started

policy origin:local policy

profile used:standard

interface:all interfaces

Name:SSDP component of UPnP framework

Port number 1900

protocol:UDP

State: disabled

Scope: local subnet only

I notice when I scroll thru this system log looking at all the differant log ins that windows go thru there is a flicker when you see each  as percentages not as the words,ie if I saw the above the typed policy origin would be as words but the local policy would flicker as a percentage then change to the typed local policy?is this normal behaviour.I know this is not NIS related but would like peace of mind as I really dont know how to read the logs and I am learning that NIS catches most things.Thanks for any insight.

Cheers Mo

8

I think we are typing at the same time!Ok I get the plugnPlay I use a plug in mouse as I don't use the Touch pad on my laptop so it goes in the USB and I can use it straight away.Thanks again

Mo

9

Hi Mo

 

There is a "service" in the Services list,

 

"Control Panel"  then "Administative Tools" the "services" 

You will see down the list, SSDP Discovery service 

 

 

  

 

Quads 

1 Like
10

Thanks Quads I know where this is are you saying stop it?There is another place that you can find out what the dependencies are for this device(In properties) if I check there first and there are no dependencies then I assume its OK to stop.I feel every time I ask a queston its like opening a can of worms.mate I do appreciate your help and everyone else on these forums.

thanks Mo

11

Mo

 

You can stop it,  you shouln't have any problems, If at any time in the future you need it, Just start the service back up again.

 

 

Quads 

12

The only thing dependant on mine is the Media Player network sharing service

13

Yes same here.thanks heaps.Thought I'd through in some school yard slang!:smileywink:

cheers Mo

14

Hi All

Any thoughts on this?

Thanks Mo