UDP Port 1900 15 times a minute?
by WildClay - 9/11/10 7:11 AM
System: HP a362n, 3GHz, 2G RAM (hardware drivers current)
Network: Comcast Broadband (no perforamnce issues on speed tests)
Cable Modem: RCA (no errors)
Router: Cisco WRT54G2 (no errors, updates current)
Nic: RealTec Ethernet
OS: XP Home Edition 2002, SP3 -- MS updates current
Firewall: Norton Internet Security (NIS)
AV: Norton, p/o NIS
MS Defender active.
MS Firewall not active.
Sorry for the long back story, but leads to where I am now, so I thought it might help in answering the actual questions.
I was looking at TeamView client and saw it was the most popular remote support software by CNet downloads, while on their site I ran the light client TeamViewQS.exe to get an idea of what the client side would look like. I don't think it is related to this, but worth mentioning as it is what has lead me to asking about it.
There were so many great reviews, I failed to look at the 8 bad reviews out of over 500 that rated it a 5. After seeing that it looked just right for my need, I decided to read the bad reviews before installing the TeamView Host, these 8 were not kind at all and claimed to brought their machines under attack as soon as they installed it. So I did not install the full TeamView.
Concerned the fast client may have done something, I opened Nortons History to look at the Firewall Activity, and noticed that 15 times a minute, consistantly, I get and inbound UDP packet trying to get to port 1900, the Norton Firewall rule blocks it.
Actions since discovering this in the Norton log:
- Full system Virus scan w/latest signatures
- System Restore to the point before I tried the TeamView Client
- Reviewed System Logs though the event viewer -- Nothing unusual in any of the logs, Security Audits all passed.
- Reviewed Defender Running Programs, nothing out of place
- Reviewed Start-up Programs (Through Defender and TUT) all good
- From cmd box, ran ipconfig /release then /renew
- Verified I got a new IP address
- Alert stopped in NIS Firewall Logs for a few minutes then started again. (meaning a few minutes after the full boot to where the system was idle)
TUT = The Ultimate Troubleshooter, slightly larger claim than what it does obviously
From SystemInternals, TCPView output on this:
Process / Protocol / Local Address / Remote Address / State
svchost.exe:1996 / UDP / zzz-zz.zzzz.ss.comcast.net.:1900 / *:* / blank
svchost.exe:1996 / UDP / zzz-zz:1900 / *:* / blank
The state for both is blank, it is not listening or anything else.
Where zzz-zz is my machine name and ss is the state I live in and they are correct.
Given that the NIS firewall is blocking this but I have no issue with my service, I am not sure why comcast is listed or why they might be trying to hit that port every 4 seconds, if that is what it means?
Norton Internet Security Message -- In the log it has "info" status.
Info -- Rule "Default Block UPnP Discovery" stealthed (xxx.xxx.1.1, Port ssdp(1900). Inbound UDP packet. - Date & Time - Status: Detected -- Action: None required. Blocked.
Advanced Details (NIS Label):
Category - Firewall - Activities
Rule - "Default Block UPnP Discovery" stealthed (xxx.xxx.1.1, Port ssdp(1900). Ibound UDP packet.
Local Address, service is (18.104.22.168, Port ssdp(1900) ).
Remote Address, service is (xxx.xxx.1.1, Port(2240) ).
Process Name is "C:\WINDOWS\system32\svchost.exe".
Looking at my TCP/IP Port Connections I see this listed:
Local IP: xxx.xxx.1.104 (my IP address after the renew)
Local Port: 1900
Remote IP: blank
Remote Port: blank
Remote Host Name: blank
State: blank (for other things it is Listen or Established...)
Q1. Does any one know why I would be getting this attempt to reach this UDP Port 15 times a minues, every 4 seconds?
I have no issues with internet performance, system performance, no errors in any logs, passed full system scan.
Q2. If this is from Comcast, should I allow this in NIS and in Defender?
Q3. If NIS is blocking this every 4 seconds I would think just the logging alone must be nipping some performance, even if I am not seeing it, so if I allowed it from Comcast, should I make explicit to them and still block all others? This would stop the blocking and logging for anything but Comcast.
Q4. I noticed when I brought up Network Setup Wizard by mistake instead of Network connections, that MS Defender detects an attempt to make a registry change to enable the port by the same instance of svchost.exe, to which I can pick Allow or Deny. I did not go into the Set-Up Wizard, just the do you want to panel at the start up of it.
Is this needed for anything if my network is already set-up and running?
Q5. Should I block this at my router, and if so, what exactly should I set up to block?
Thanks for any info, I hunted around and got all kinds of answers but no "theme" so I have no idea which one is right, except that it is a network discovery service similar to PnP for hardware, auto-detection and config of network stuff?
Some say disable it, it is a network discovery service XP starts but is not needed, others say it is other PC's on my Comcast network "loop" doing some kind of broadcast, and others say never disable it or you will have issues and the list of the alleged issues vary from person to person.
So I am hoping the right answers are here, again thanks and sorry for the long read.