RE: SCAN UPnP service discover attempt

[<bmcdowell () coxhealthplans com>]

Watch for MSN Messenger users trying to use anything other than IM (as in voice, file transfer, etc.)  They have an 
article on why all of this uses UPnP somewhere in their knowledgebase.

Personally, I'd just like to make UPnP work via conntrack in my iptables, but that's another story.

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Joerg Weber
Sent: Wednesday, June 04, 2003 10:34 AM
To: SnortUsers
Subject: Re: [Snort-users] SCAN UPnP service discover attempt


Hi Mark,

I'm not exactly a windows expert, but as far as I know, do Windows XP
clients by default look for what is called UPnP device descriptions via
UPnP. That's why you'r seeing these alerts IMO.

Have a look at
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-059.asp
for some info about the UPnP service and bugs within it.

Hope I could help,

Joerg

> Greetings,
>
>    There are two hosts on this network that every 5 seconds or so cause 
> snort to alert
>
>            [**] [1:1917:4] SCAN UPnP service discover attempt [**]
>            [Classification: Detection of a Network Scan] [Priority: 3]
>             ...........

-- 
Joerg Weber
Network Security

infoServe GmbH
Nell-Breuning-Allee 6
D-66115 Saarbruecken

T: (0681) 8 80 08 - 0
F: (0681) 8 80 08 - 59
www.infos.de
E: j.weber () infos de


-------------------------------------------------------
This SF.net email is sponsored by:  Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users