Solved

Windows 7 Port 1900UDP Linksys RV042 Synflood Alerts?

Posted on 2010-08-16
5
1,679 Views
Last Modified: 2012-05-10
Hello Experts,

I'm getting from my RV042 router alerts about synflooding that's occuring on the network... here's a sample of the log:

Sun Aug 15 22:04:35 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.25:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 22:04:35 2010
RGFW-RATELIMIT: 2 messages of type BLOCK-SYNFLOOD reported 2 second(s) ago
Sun Aug 15 22:04:33 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.25:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 22:04:33 2010
RGFW-RATELIMIT: 1 messages of type BLOCK-SYNFLOOD reported 1 second(s) ago
Sun Aug 15 22:04:32 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.25:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 22:04:32 2010
RGFW-RATELIMIT: 5 messages of type BLOCK-SYNFLOOD reported 29 second(s) ago
Sun Aug 15 22:04:03 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.30:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 22:04:03 2010
RGFW-RATELIMIT: 5 messages of type BLOCK-SYNFLOOD reported 3 second(s) ago
Sun Aug 15 22:04:00 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.30:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 22:04:00 2010
RGFW-RATELIMIT: 5 messages of type BLOCK-SYNFLOOD reported 3 second(s) ago
Sun Aug 15 22:03:57 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.30:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 22:03:57 2010
RGFW-RATELIMIT: 5 messages of type BLOCK-SYNFLOOD reported 85 second(s) ago
Sun Aug 15 22:02:31 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.24:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 22:02:31 2010
RGFW-RATELIMIT: 5 messages of type BLOCK-SYNFLOOD reported 3 second(s) ago
Sun Aug 15 22:02:29 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.24:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 22:02:29 2010
RGFW-RATELIMIT: 5 messages of type BLOCK-SYNFLOOD reported 3 second(s) ago
Sun Aug 15 22:02:26 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.24:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 21:57:19 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.25:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 21:57:18 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.25:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 21:57:18 2010
RGFW-RATELIMIT: 2 messages of type BLOCK-SYNFLOOD reported 1 second(s) ago
Sun Aug 15 21:57:17 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.25:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 21:57:17 2010
RGFW-RATELIMIT: 1 messages of type BLOCK-SYNFLOOD reported 1 second(s) ago
Sun Aug 15 21:57:16 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.25:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 21:57:15 2010
RGFW-IN: BLOCK-RULES (UDP 192.168.1.25:1900->239.255.255.250:1900 on ixp1) [20,1]
Sun Aug 15 21:57:15 2010
RGFW-RATELIMIT: 2 messages of type BLOCK-SYNFLOOD reported 1 second(s) ago
Sun Aug 15 21:57:14 2010

Note that 192.168.1.24, .25 and .30 are 3 windows 7 machines that were recently added to the network.  

I did a bit of googling and it looks like the machines might be generating UPnP traffic?  Can someone confirm this, and how would I go about stopping them from broadcasting this, so that my firewall log doesn't send me these what appear to be false positive alerts...

Thanks!
0
Comment
Question by:taki1gostek
  • 3
  • 2
5 Comments
 
LVL 5

Expert Comment

by:TechnicallyMaybe
ID: 33445757
You are correct about UPnP and SSDP using udp 1900.
If you don't want Windows 7 to discover network devices, disable SSDP Discovery service.
To disable UPnP, stop the UPnP Device Host service.
Set both service startup to disabled to prevent them from starting on next reboot.

Even with both services disabled, you still may see the broadcasts, if so, make the following reg change:
Hive: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\DirectPlayNATHelp\DPNHUPnP
Name: UPnPMode
Type: REG_DWORD
Value: 2 disabled
With UPnPMode=2, Universal Plug and Play Network Address Translation (NAT) traversal discovery does not occur.
0
 
LVL 2

Author Comment

by:taki1gostek
ID: 33445976
thanks for the tip -- any chance I could make this happen using GP?
0
 
LVL 5

Expert Comment

by:TechnicallyMaybe
ID: 33447476
See the image for the location in GP to control services.

For the reg change.  You can create a .reg file and execute it through the logon script.
0
 
LVL 5

Accepted Solution

by:
TechnicallyMaybe earned 250 total points
ID: 33447483
Sorry - here is the image I was referring to.
image15.png
0
 
LVL 2

Author Closing Comment

by:taki1gostek
ID: 33454210
Thanks, technically, maybe :)
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Suggested Solutions

If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
This Micro Tutorial will give you basic overview of the control panel section on Windows 7. It will depth in Network and Internet, Hardware and Sound, etc. This will be demonstrated using Windows 7 operating system.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now