This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

A lot of SSDP default drop, why?

I have some problem figuring out what the cause of the massive SSDP drop on my firewall. Yesterday I had 90 611 dropped packets on the firewall. Anyone have an idea of what causing this issue? I have added some live log if it is to any help.

Thanks!

01:09:13	Default DROP	SSDP	  108.162.242.191:80→myip:1900 len=118	ttl=244	tos=0x00	srcmac=XX tmac=XX



01:09:13	Default DROP	SSDP	  66.249.84.248:80→myip:1900 len=118	ttl=244	tos=0x00	srcmac=XX	dstmac=XX



01:09:13	Default DROP	SSDP	 66.249.84.248:80→myip:1900 len=118	ttl=244	tos=0x00	srcmac=XX	dstmac=XX



01:09:13	Default DROP	SSDP	 66.249.84.248:80→myip:1900 len=118	ttl=244	tos=0x00	srcmac=XX	dstmac=XX



01:09:15	Default DROP	SSDP	 5.196.36.119:27015→myip:1900 len=118	ttl=244	tos=0x00	srcmac=XX	dstmac=XX

This thread was automatically locked due to age.

Parents

0 kohvirus over 10 years ago

Just a follow-up I might have gotten some information wrong so I attached a SANs article that hopefully details it some. Again make your own analysis but maybe this can be a good supplement: SANS: Malware FAQ: Microsoft Windows UPnP vulnerabilities
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 kohvirus over 10 years ago

Just a follow-up I might have gotten some information wrong so I attached a SANs article that hopefully details it some. Again make your own analysis but maybe this can be a good supplement: SANS: Malware FAQ: Microsoft Windows UPnP vulnerabilities
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data