[Snort-users] SCAN UPnP service discover attempt

Joerg Weber j.weber at ...8292...
Wed Jun 4 08:34:16 EDT 2003

Hi Mark,

I'm not exactly a windows expert, but as far as I know, do Windows XP
clients by default look for what is called UPnP device descriptions via
UPnP. That's why you'r seeing these alerts IMO.

Have a look at
for some info about the UPnP service and bugs within it.

Hope I could help,


> Greetings,
>    There are two hosts on this network that every 5 seconds or so cause 
> snort to alert
>            [**] [1:1917:4] SCAN UPnP service discover attempt [**]
>            [Classification: Detection of a Network Scan] [Priority: 3]
>             ...........

Joerg Weber
Network Security

infoServe GmbH
Nell-Breuning-Allee 6
D-66115 Saarbruecken

T: (0681) 8 80 08 - 0
F: (0681) 8 80 08 - 59
E: j.weber at ...8292...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030604/0af4f64a/attachment.sig>

More information about the Snort-users mailing list