[Snort-users] SCAN UPnP service discover attempt

Mark Williamson snortuser at ...9376...
Wed Jun 4 08:27:18 EDT 2003

Michel - It is definately stopped - not disabled, still it ticks :(

Ahh, Thank you Thomas - This sounds like it might be the issue then,  
So i just grep away these entries for this host from my alert log i 

- Still, this seems strange to me - I believe all of the XP 
installations here to be of the same version with the same patches 
applied which makes it strange that 2 of them insist on sending UPnP 
while the rest are happy

Time for some more investigation into versions i suppose although why 
they can't just use linux and have done with these stealthy services 
trying to be helpful for them i still don't know .

Thanks all, you have been most helpful,

Best Regards

Thomas T. Evans, III wrote:

>XP is a big fan of UPnP scanning and I have one machine that refuses to
>stop. There is a Q article somewhere on steps you can take to disable it,
>but in our case, the machine refused to cooperate.
>Thomas T. Evans, III CCNA
>Senior Network Manager
>Hawk Corporation
>ttevans at ...7399...
>216-267-7787 Ext. 500
>Cell: 440-669-2526
>Fax: 917-464-7241
>President, MFG/Pro Midwest User Group

More information about the Snort-users mailing list