[Snort-users] Re: SCAN UPnP service discover attempt

Michael.Mulholland at ...9481... Michael.Mulholland at ...9481...
Tue Dec 30 06:28:03 EST 2003


Folks,

I'm getting a number of the above alerts & i'm not sure what the source
addresses are looking for.

Machines on my subnet and only my subnet out of 40+ lans are triggering the
rule for a SCAN UPnP service discover attempt

The M-Search phrase seems to be the reason for the alert - I get the
following message:

|-----------------------------------------------------------------------------|
| 000 : 4D 2D 53 45 41 52 43 48 20 2A 20 48 54 54 50 2F   M-SEARCH * HTTP/    |
| 010 : 31 2E 31 0D 0A 48 4F 53 54 3A 20 32 33 39 2E 32   1.1..HOST: 239.2    |
| 020 : 35 35 2E 32 35 35 2E 32 35 30 3A 31 39 30 30 0D   55.255.250:1900.    |
| 030 : 0A 4D 41 4E 3A 20 22 73 73 64 70 3A 64 69 73 63   .MAN: "ssdp:disc    |
| 040 : 6F 76 65 72 22 0D 0A 4D 58 3A 20 32 0D 0A 53 54   over"..MX: 2..ST    |
| 050 : 3A 20 75 72 6E 3A 73 63 68 65 6D 61 73 2D 75 70   : urn:schemas-up    |
| 060 : 6E 70 2D 6F 72 67 3A 73 65 72 76 69 63 65 3A 57   np-org:service:W    |
| 070 : 41 4E 49 50 43 6F 6E 6E 65 63 74 69 6F 6E 3A 31   ANIPConnection:1    |
| 080 : 0D 0A 0D 0A                                       ....                |
|                                                                             |
|-----------------------------------------------------------------------------|



I take it this is a false positive but i'm curious as to exactly whats
happening - the destination address in each case is my router and the
destination port in each alert is 1900 (SSDP) over udp

Any views/opinions are gratefully accepted

thanks

michael mulholland



*******************************************************************************************

Any views expressed by the sender of this message are not necessarily those
of the Department of Finance & Personnel and the Office of the First
Minister and the Deputy First Minister.  This email and any files
transmitted with it are intended solely for the use of the individual or
entity to whom they are addressed.  If you have received this email in
error please notify the sender immediately by using the reply facility in
your email software.  All emails are swept for the presence of viruses.
********************************************************************************************





More information about the Snort-users mailing list