Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


1531 posts

Uber Geek
+1 received by user: 379


Topic # 150788 3-Aug-2014 12:38
Send private message

I have my firewall only accepting forwarded connections that are initiated (new) from known devices on my internal network.  Anything else, with the exception of a dst-nat (port forward) rule created for torrents is blocked.  This includes anything that creates a upnp port forward.  If you're not something I know of, you get blocked and labelled a 'spammer'.  Should a 'spammer' try any unsolicited connection a second time, they get blocked outright with no exceptions for a duration of time.

Through this I notice in the logs that every few seconds there are connection attempts being made to a UPnP created port forward entry, as follows:



Running netstat -ao shows that the service is as highlighted below:


Any ideas?

Create new topic
Infrastructure Geek
4056 posts

Uber Geek
+1 received by user: 195

Trusted
Microsoft NZ
Subscriber

  Reply # 1101339 3-Aug-2014 22:33
Send private message

cant quite read the text in the first image




Technical Evangelist
Microsoft NZ
about.me/nzregs
Twitter: @nzregs


1176 posts

Uber Geek
+1 received by user: 262


  Reply # 1101345 3-Aug-2014 22:45
Send private message

Looks like torrent related traffic to me. It is not unusual to still receive traffic from peers for hours/days even after you close your client.
Could also be Skype.



1531 posts

Uber Geek
+1 received by user: 379


  Reply # 1101370 4-Aug-2014 00:05
Send private message

^ no, it's not torrent traffic. the port forward was created by upnp. what created the port forward?  service with pid 972 as per my screenshot.

if you hit quote on my post you'll see the data easier.


2382 posts

Uber Geek
+1 received by user: 694

Trusted
Lifetime subscriber

  Reply # 1101417 4-Aug-2014 07:38
Send private message

Capture a few second traffic using WireShark maybe?




"4 wheels move the body.  2 wheels move the soul."

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams



1531 posts

Uber Geek
+1 received by user: 379


  Reply # 1101663 4-Aug-2014 12:37
Send private message

yeah the device can do this by itself to a file ... will have to when I get more time (it's only my home router :))

Just rather odd that considering that a windows service is opening up a port, then i'm getting attempts to it from random non-microsoft addresses.  my initial thoughts are something like onedrive might have a push update function, and third parties are somehow able to abuse this.

should be interesting as it could effect everyone with windows 8 seeing all domestic routers nowadays have upnp enabled and will blindly accept traffic



1531 posts

Uber Geek
+1 received by user: 379


  Reply # 1102820 5-Aug-2014 19:33
Send private message

Not particularly human readable

[headers stripped]
Data (52 bytes)
0000 60 00 00 00 00 00 3b 15 20 01 00 00 9d 38 6a b8 `.....;. ....8j.
0010 24 f6 36 66 c5 53 f1 79 20 01 00 00 9d 38 90 d7 $.6f.S.y ....8..
0020 0c 3c 33 4d 86 9c e4 12 01 04 79 a6 23 11 04 04 .<3M......y.#...
0030 00 00 00 00 ....

Infrastructure Geek
4056 posts

Uber Geek
+1 received by user: 195

Trusted
Microsoft NZ
Subscriber

  Reply # 1102950 5-Aug-2014 22:16
Send private message

MadEngineer: ^ no, it's not torrent traffic. the port forward was created by upnp. what created the port forward?  service with pid 972 as per my screenshot.

if you hit quote on my post you'll see the data easier.



What about Skype?  Do you have that running?  (question asked alongside torrents above)

As for the pid972, may be the "IP Helper" or another service - perhaps an app (may well be nothing to do with windows) on your machine is calling a upnp api via that windows service




Technical Evangelist
Microsoft NZ
about.me/nzregs
Twitter: @nzregs




1531 posts

Uber Geek
+1 received by user: 379


  Reply # 1103737 7-Aug-2014 00:05
Send private message

I have skype installed, but it doesn't run on startup and isn't sitting in the background.  my machine is quite clean

Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

N4L helping TAKA Trust bridge the digital divide for Lower Hutt students
Posted 18-Jun-2018 13:08


Winners Announced for 2018 CIO Awards
Posted 18-Jun-2018 13:03


Logitech Rally sets new standard for USB-connected video conference cameras
Posted 18-Jun-2018 09:27


Russell Stanners steps down as Vodafone NZ CEO
Posted 12-Jun-2018 09:13


Intergen recognised as 2018 Microsoft Country Partner of the Year for New Zealand
Posted 12-Jun-2018 08:00


Finalists Announced For Microsoft NZ Partner Awards
Posted 6-Jun-2018 15:12


Vocus Group and Vodafone announce joint venture to accelerate fibre innovation
Posted 5-Jun-2018 10:52


Kogan.com to launch Kogan Mobile in New Zealand
Posted 4-Jun-2018 14:34


Enable doubles fibre broadband speeds for its most popular wholesale service in Christchurch
Posted 2-Jun-2018 20:07


All or Nothing: New Zealand All Blacks arrives on Amazon Prime Video
Posted 2-Jun-2018 16:21


Innovation Grant, High Tech Awards and new USA office for Kiwi tech company SwipedOn
Posted 1-Jun-2018 20:54


Commerce Commission warns Apple for misleading consumers about their rights
Posted 30-May-2018 13:15


IBM leads Call for Code to use cloud, data, AI, blockchain for natural disaster relief
Posted 25-May-2018 14:12


New FUJIFILM X-T100 aims to do better job than smartphones
Posted 24-May-2018 20:17


Stuff takes 100% ownership of Stuff Fibre
Posted 24-May-2018 19:41



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.