Re: SCAN UPnP service discover attempt

[Mark Williamson <snortuser () nunswithguns co uk>]

Michel - It is definately stopped - not disabled, still it ticks :(

Ahh, Thank you Thomas - This sounds like it might be the issue then,  
thanks,
So i just grep away these entries for this host from my alert log i 
suppose.

- Still, this seems strange to me - I believe all of the XP 
installations here to be of the same version with the same patches 
applied which makes it strange that 2 of them insist on sending UPnP 
while the rest are happy
without.

Time for some more investigation into versions i suppose although why 
they can't just use linux and have done with these stealthy services 
trying to be helpful for them i still don't know .


Thanks all, you have been most helpful,


Best Regards
Mark




Thomas T. Evans, III wrote:

> Mark:
>
> XP is a big fan of UPnP scanning and I have one machine that refuses to
> stop. There is a Q article somewhere on steps you can take to disable it,
> but in our case, the machine refused to cooperate.
>
> Thomas T. Evans, III CCNA
> Senior Network Manager
> Hawk Corporation
> ttevans () hawkcorp net
> 216-267-7787 Ext. 500
> Cell: 440-669-2526
> Fax: 917-464-7241
> President, MFG/Pro Midwest User Group
>
>  



-------------------------------------------------------
This SF.net email is sponsored by:  Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users