Prev: Error 80042109 on sending mails
Next: Setting up FTP Service
From: VanguardLH on 8 Jul 2008 17:00
JClark wrote:

> VanguardLH wrote:
>
>> Is UPnP enabled in the router? Try disabling it or check that it is
>> disabled.
>
> Yes, UPnP is disabled in the router.

I'm wondering in "2008/07/08, 05:40:15.921, GMT -0400, 2010, Device 3"
as to what is "device 3". Might it be whatever is plugged into the port
numbered 3 on the router? If so, is that your host or another one? If
another one, try yanking the cable out of port #3 on the router to see
if it all quiets down.
From: JClark on 8 Jul 2008 18:04
On Tue, 8 Jul 2008 16:00:45 -0500, VanguardLH <V(a)nguard.LH> wrote:

>JClark wrote:
>
>> VanguardLH wrote:
>>
>>> Is UPnP enabled in the router? Try disabling it or check that it is
>>> disabled.
>>
>> Yes, UPnP is disabled in the router.
>
>I'm wondering in "2008/07/08, 05:40:15.921, GMT -0400, 2010, Device 3"
>as to what is "device 3". Might it be whatever is plugged into the port
>numbered 3 on the router? If so, is that your host or another one? If
>another one, try yanking the cable out of port #3 on the router to see
>if it all quiets down.
Hello VanguardLH,

The firewall (Deerfield Visnetic) recognizes and lists four devices or
"adapters".
#1 is labeled \DEVICE\NDISWANBH (? a WAN miniport)
# 2 is labeled Dialup Adapter
#3 is labeled Local Area Connection
#4 is labeled Local Area Connection

(#3 and #4 correspond to two LAN connections on the motherboard, which
correspond to two networking adapters seen in Device Manager. Only the
one corresponding to Local Area Connection #3 on the firewall is being
used.)

I have configured the firewall to block everything on adapters #1
and #2 and #4.

The one I use is Device #3, LAN.

Returning to the original question, a summary, as I see it (not
necessarily correctly):

It seems the router is sending udp packets to 255.255.255.255 (both
source and destination ports = 520, or to 192.168.1.255 (source port
ranging from 7000 to 7259, and destination port 162.

I have no idea what this all means.

Again, I appreciate your help.

Jack



From: Anonymous on 9 Jul 2008 03:35
JClark wrote:
....
> It seems the router is sending udp packets to 255.255.255.255 (both
> source and destination ports = 520, or to 192.168.1.255 (source port
> ranging from 7000 to 7259, and destination port 162.

Ansgar already explained, but since you wrote

> I have no idea what this all means.

I will repaeat one more time, and I will provide some links to
additional informations.

That is broadcast[1]

UDP 520 is a port used by Routing Information Protocol (RIP) [2] and [3].

UDP 162 is a port used by Simple Network Management Protocol (SNMP) [4]
and [5]

IMO everything is OK. But to be sure follow Ansgar advice and inspect
packet content, you can use, for example, Wireshark[6].

[1] http://en.wikipedia.org/wiki/Broadcast_address
[2] http://www.auditmypc.com/port/udp-port-520.asp
[3] http://en.wikipedia.org/wiki/Routing_Information_Protocol
[4] http://www.auditmypc.com/port/udp-port-162.asp
[5] http://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
[6] http://www.wireshark.org/
From: JClark on 9 Jul 2008 07:34
On Wed, 09 Jul 2008 09:35:58 +0200, "@lf" <alf(a)lf.alf> wrote:

>JClark wrote:
>...
>> It seems the router is sending udp packets to 255.255.255.255 (both
>> source and destination ports = 520, or to 192.168.1.255 (source port
>> ranging from 7000 to 7259, and destination port 162.
>
>Ansgar already explained, but since you wrote
>
>> I have no idea what this all means.
>
>I will repaeat one more time, and I will provide some links to
>additional informations.
>
>That is broadcast[1]
>
>UDP 520 is a port used by Routing Information Protocol (RIP) [2] and [3].
>
>UDP 162 is a port used by Simple Network Management Protocol (SNMP) [4]
>and [5]
>
>IMO everything is OK. But to be sure follow Ansgar advice and inspect
>packet content, you can use, for example, Wireshark[6].
>
>[1] http://en.wikipedia.org/wiki/Broadcast_address
>[2] http://www.auditmypc.com/port/udp-port-520.asp
>[3] http://en.wikipedia.org/wiki/Routing_Information_Protocol
>[4] http://www.auditmypc.com/port/udp-port-162.asp
>[5] http://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
>[6] http://www.wireshark.org/
Many thanks! I will spend some time on the links you have provided and
perhaps become better informed.
I may also post something in the Linksys forum (presuming there is
one) to see if I have the router configured correctly.
Again, thanks.

Jack
From: VanguardLH on 9 Jul 2008 13:32
JClark wrote:

> On Tue, 8 Jul 2008 16:00:45 -0500, VanguardLH <V(a)nguard.LH> wrote:
>
>>JClark wrote:
>>
>>> VanguardLH wrote:
>>>
>>>> Is UPnP enabled in the router? Try disabling it or check that it is
>>>> disabled.
>>>
>>> Yes, UPnP is disabled in the router.
>>
>>I'm wondering in "2008/07/08, 05:40:15.921, GMT -0400, 2010, Device 3"
>>as to what is "device 3". Might it be whatever is plugged into the port
>>numbered 3 on the router? If so, is that your host or another one? If
>>another one, try yanking the cable out of port #3 on the router to see
>>if it all quiets down.
> Hello VanguardLH,
>
> The firewall (Deerfield Visnetic) recognizes and lists four devices or
> "adapters".
> #1 is labeled \DEVICE\NDISWANBH (? a WAN miniport)
> # 2 is labeled Dialup Adapter
> #3 is labeled Local Area Connection
> #4 is labeled Local Area Connection
>
> (#3 and #4 correspond to two LAN connections on the motherboard, which
> correspond to two networking adapters seen in Device Manager. Only the
> one corresponding to Local Area Connection #3 on the firewall is being
> used.)
>
> I have configured the firewall to block everything on adapters #1
> and #2 and #4.
>
> The one I use is Device #3, LAN.
>
> Returning to the original question, a summary, as I see it (not
> necessarily correctly):
>
> It seems the router is sending udp packets to 255.255.255.255 (both
> source and destination ports = 520, or to 192.168.1.255 (source port
> ranging from 7000 to 7259, and destination port 162.
>
> I have no idea what this all means.
>
> Again, I appreciate your help.
>
> Jack

Oops, my bad. I thought the "log" was from the router's firewall, not
from your software firewall on your intranet host. Have you checked
your router's logs? Did you enable logging in the router? Sometimes
the router's logs are not so easy to read plus it might be limited in
the number of records retained. WallWatcher works with some routers to
extract their logs so you can review them locally.
First  |  Prev  |  Next  |  Last
Pages: 1 2 3 4 5
Prev: Error 80042109 on sending mails
Next: Setting up FTP Service