This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Traffic on port 1900 ??

Can someome please explain me what this is.

"12:08:36 192.168.1.146 1079  ->  192.168.1.2 1900 UDP
12:08:36 192.168.1.146 1079  ->  192.168.1.2 1900 UDP
12:08:36 192.168.1.146 1079  ->  192.168.1.2 1900 UDP
12:08:36 192.168.1.146 1079  ->  192.168.1.2 1900 UDP
12:08:38 192.168.1.104 1072  ->  192.168.1.2 1900 UDP
12:08:38 192.168.1.104 1072  ->  192.168.1.2 1900 UDP
12:08:39 192.168.1.104 1072  ->  192.168.1.2 1900 UDP
12:08:39 192.168.1.104 1072  ->  192.168.1.2 1900 UDP
"

None of the machines have the UPNP exploit, SSDP & UPNP services is not running

This thread was automatically locked due to age.

0 fredde over 23 years ago

That is some windows crap, turn of the service called
"universal plug and play device host"

/f
Cancel
Vote Up 0 Vote Down

Cancel
0 ECKEROTH over 23 years ago in reply to fredde

"None of the machines have the UPNP exploit, SSDP & UPNP services is not running"

Universal plug and play device host IS DISABLED on both hosts.
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike_Cunningham over 23 years ago in reply to ECKEROTH

UDP Port 1900 is used by some peer to peer sharing programs like Bearshare or Kazaa.

Mike
Cancel
Vote Up 0 Vote Down

Cancel
0 ECKEROTH over 23 years ago in reply to Mike_Cunningham

Kazaa.
Hmmmm. I'l have a look

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Manctastic over 21 years ago in reply to ECKEROTH

This traffic is casued by msn messenger, at least on my network it is.
Cancel
Vote Up 0 Vote Down

Cancel
0 ReD-MaN over 21 years ago in reply to Manctastic

Yup, MSNMSGR is it. This is basically MSN and its determining if it can use the voice and video stuff, etc.

Try seeing this on a network with over 50 hosts doing this.
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 21 years ago in reply to ReD-MaN

If you tell the firewall to reject these packets (not drop) the Windows boxes will figure out it cant use it and stop sending the packets. Then they will only periodically test after that.
Cancel
Vote Up 0 Vote Down

Cancel
0 VelvetFog over 21 years ago

I have seen the same port 1900 traffic originating from my WinXP machines.

I created a PORT-1900 service definition on my ASL v4 box, and then added the service to my "Drop-Service" service group, which I use in a packet filter drop rule. That blocks the port 1900 traffic and keeps it out of the logs.
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 21 years ago in reply to VelvetFog

VelvetFog, if you reject the service the uPNP service will figure it out and stop trying, (apart from periodic tests).

This is all the accursed uPNP services...
Cancel
Vote Up 0 Vote Down

Cancel
0 VelvetFog over 21 years ago in reply to Simon Shaw

[ QUOTE ]
VelvetFog, if you reject the service the uPNP service will figure it out and stop trying, (apart from periodic tests).

[/ QUOTE ]Sounds good to me. [:)]

[ QUOTE ]
This is all the accursed uPNP services...

[/ QUOTE ]Which, in my view, is an unneeded feature that only creates a security hole.
Cancel
Vote Up 0 Vote Down

Cancel