Re: SCAN UPnP service discover attempt

[Michael.Mulholland () dfpni gov uk]

Folks,

I'm getting a number of the above alerts & i'm not sure what the source
addresses are looking for.

Machines on my subnet and only my subnet out of 40+ lans are triggering the
rule for a SCAN UPnP service discover attempt

The M-Search phrase seems to be the reason for the alert - I get the
following message:

|-----------------------------------------------------------------------------|
| 000 : 4D 2D 53 45 41 52 43 48 20 2A 20 48 54 54 50 2F   M-SEARCH * HTTP/    |
| 010 : 31 2E 31 0D 0A 48 4F 53 54 3A 20 32 33 39 2E 32   1.1..HOST: 239.2    |
| 020 : 35 35 2E 32 35 35 2E 32 35 30 3A 31 39 30 30 0D   55.255.250:1900.    |
| 030 : 0A 4D 41 4E 3A 20 22 73 73 64 70 3A 64 69 73 63   .MAN: "ssdp:disc    |
| 040 : 6F 76 65 72 22 0D 0A 4D 58 3A 20 32 0D 0A 53 54   over"..MX: 2..ST    |
| 050 : 3A 20 75 72 6E 3A 73 63 68 65 6D 61 73 2D 75 70   : urn:schemas-up    |
| 060 : 6E 70 2D 6F 72 67 3A 73 65 72 76 69 63 65 3A 57   np-org:service:W    |
| 070 : 41 4E 49 50 43 6F 6E 6E 65 63 74 69 6F 6E 3A 31   ANIPConnection:1    |
| 080 : 0D 0A 0D 0A                                       ....                |
|                                                                             |
|-----------------------------------------------------------------------------|



I take it this is a false positive but i'm curious as to exactly whats
happening - the destination address in each case is my router and the
destination port in each alert is 1900 (SSDP) over udp

Any views/opinions are gratefully accepted

thanks

michael mulholland



*******************************************************************************************

Any views expressed by the sender of this message are not necessarily those
of the Department of Finance & Personnel and the Office of the First
Minister and the Deputy First Minister.  This email and any files
transmitted with it are intended solely for the use of the individual or
entity to whom they are addressed.  If you have received this email in
error please notify the sender immediately by using the reply facility in
your email software.  All emails are swept for the presence of viruses.
********************************************************************************************



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users