[Snort-users] Re: SCAN UPnP service discover attempt

Brian F. Vaughan bvaughan at ...6569...
Tue Dec 30 06:30:02 EST 2003


Michael,

Do any of the machines have Windows XP installed on them. Generally
Windows XP machines will scan for UPnP services. You should, however,
disable that service on the individual workstations unless the service
is needed...


Brian Vaughan
IT Administrator
Wireless Generation, Inc.


Handheld Tools for Teachers
That Make Classroom Assessment Easy

-----Original Message-----
From: Michael.Mulholland at ...9481...
[mailto:Michael.Mulholland at ...9481...] 
Sent: Tuesday, December 30, 2003 9:20 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Re: SCAN UPnP service discover attempt

Folks,

I'm getting a number of the above alerts & i'm not sure what the source
addresses are looking for.

Machines on my subnet and only my subnet out of 40+ lans are triggering
the
rule for a SCAN UPnP service discover attempt

The M-Search phrase seems to be the reason for the alert - I get the
following message:

|-----------------------------------------------------------------------
------|
| 000 : 4D 2D 53 45 41 52 43 48 20 2A 20 48 54 54 50 2F   M-SEARCH *
HTTP/    |
| 010 : 31 2E 31 0D 0A 48 4F 53 54 3A 20 32 33 39 2E 32   1.1..HOST:
239.2    |
| 020 : 35 35 2E 32 35 35 2E 32 35 30 3A 31 39 30 30 0D
55.255.250:1900.    |
| 030 : 0A 4D 41 4E 3A 20 22 73 73 64 70 3A 64 69 73 63   .MAN:
"ssdp:disc    |
| 040 : 6F 76 65 72 22 0D 0A 4D 58 3A 20 32 0D 0A 53 54   over"..MX:
2..ST    |
| 050 : 3A 20 75 72 6E 3A 73 63 68 65 6D 61 73 2D 75 70   :
urn:schemas-up    |
| 060 : 6E 70 2D 6F 72 67 3A 73 65 72 76 69 63 65 3A 57
np-org:service:W    |
| 070 : 41 4E 49 50 43 6F 6E 6E 65 63 74 69 6F 6E 3A 31
ANIPConnection:1    |
| 080 : 0D 0A 0D 0A                                       ....
|
|
|
|-----------------------------------------------------------------------
------|



I take it this is a false positive but i'm curious as to exactly whats
happening - the destination address in each case is my router and the
destination port in each alert is 1900 (SSDP) over udp

Any views/opinions are gratefully accepted

thanks

michael mulholland


************************************************************************
*******************

Any views expressed by the sender of this message are not necessarily
those
of the Department of Finance & Personnel and the Office of the First
Minister and the Deputy First Minister.  This email and any files
transmitted with it are intended solely for the use of the individual or
entity to whom they are addressed.  If you have received this email in
error please notify the sender immediately by using the reply facility
in
your email software.  All emails are swept for the presence of viruses.
************************************************************************
********************



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for
IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys
admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list