RE: Re: SCAN UPnP service discover attempt

["Brian F. Vaughan" <bvaughan () wgen net>]

Michael,

Do any of the machines have Windows XP installed on them. Generally
Windows XP machines will scan for UPnP services. You should, however,
disable that service on the individual workstations unless the service
is needed...


Brian Vaughan
IT Administrator
Wireless Generation, Inc.


Handheld Tools for Teachers
That Make Classroom Assessment Easy

-----Original Message-----
From: Michael.Mulholland () dfpni gov uk
[mailto:Michael.Mulholland () dfpni gov uk] 
Sent: Tuesday, December 30, 2003 9:20 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Re: SCAN UPnP service discover attempt

Folks,

I'm getting a number of the above alerts & i'm not sure what the source
addresses are looking for.

Machines on my subnet and only my subnet out of 40+ lans are triggering
the
rule for a SCAN UPnP service discover attempt

The M-Search phrase seems to be the reason for the alert - I get the
following message:

|-----------------------------------------------------------------------
------|
| 000 : 4D 2D 53 45 41 52 43 48 20 2A 20 48 54 54 50 2F   M-SEARCH *
HTTP/    |
| 010 : 31 2E 31 0D 0A 48 4F 53 54 3A 20 32 33 39 2E 32   1.1..HOST:
239.2    |
| 020 : 35 35 2E 32 35 35 2E 32 35 30 3A 31 39 30 30 0D
55.255.250:1900.    |
| 030 : 0A 4D 41 4E 3A 20 22 73 73 64 70 3A 64 69 73 63   .MAN:
"ssdp:disc    |
| 040 : 6F 76 65 72 22 0D 0A 4D 58 3A 20 32 0D 0A 53 54   over"..MX:
2..ST    |
| 050 : 3A 20 75 72 6E 3A 73 63 68 65 6D 61 73 2D 75 70   :
urn:schemas-up    |
| 060 : 6E 70 2D 6F 72 67 3A 73 65 72 76 69 63 65 3A 57
np-org:service:W    |
| 070 : 41 4E 49 50 43 6F 6E 6E 65 63 74 69 6F 6E 3A 31
ANIPConnection:1    |
| 080 : 0D 0A 0D 0A                                       ....
|
|
|
|-----------------------------------------------------------------------
------|



I take it this is a false positive but i'm curious as to exactly whats
happening - the destination address in each case is my router and the
destination port in each alert is 1900 (SSDP) over udp

Any views/opinions are gratefully accepted

thanks

michael mulholland


************************************************************************
*******************

Any views expressed by the sender of this message are not necessarily
those
of the Department of Finance & Personnel and the Office of the First
Minister and the Deputy First Minister.  This email and any files
transmitted with it are intended solely for the use of the individual or
entity to whom they are addressed.  If you have received this email in
error please notify the sender immediately by using the reply facility
in
your email software.  All emails are swept for the presence of viruses.
************************************************************************
********************



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for
IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys
admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users