Unknown UPnP port

Happy Birthday, Damob9k!

Cheers dj99,

On my second helping of JD now, must stop as I have to get up at 7 ... ish

Ok really need to step away from the laptop now and get some sleep !

Cheers

Damo

Look I am sorry logicearth,

But you are just wrong !
The low level system that you are referring to IS UDP & TPC/IP.

When you establish a connection to a server, you connect to port 80. However, then the server sends back a reply, it does not use port 80 on the client. The client opens an random port again in the 40000+ range. This port is what accepts the reply from the server. The client send commands to port 80, the server send commands to a random port defined by the client.

Again , you are incorrect, Web browsers are designed to work on specific ports, you can change these ports for ssl, https , ftp and socks in the browser config, but only if the server you are connecting to is configured the same way.
Which ever port you set it to will be the listening port for http or https etc.
How could you configure a firewall to protect your network from attacks if the server you connect to is replying on a randon port, you couldn't !

Obviously this port you are trying to close is important enough to keep open and or is required for doing the task at hand.

Operating systems them selves don't instigate opening of ports via UPnP, applications and devises do.
There for it is an application that is doing this, and as I have not installed any applications that use UPnP on this pc and very few applications do automatically start using UPnP (you generally have to tell them to use it) there is something odd about this, hence my investigations.

Why else would UPnP override the firewall if you blocked it?

As I have already said... this is the basic function of UPnP. It wouldn't be very affective if it didn't create a firewall rule, and not letting the UPnP software communicate with the outside world.

If you want to waste your time goose chasing a dynamic/random port that can be used by any network service then go ahead. However, it is all rather pointless if that port is completely blocked by the routers firewall from remote access (AKA., the internet.) Use shields up if you want to be sure.

The only thing that is wasting my time and is also pointless, is replying to these incorrect and argumentative comments.
I spend most of my working day dealing with people that think they know what they are talking about, and I am not prepared to spend my personal time doing this.
I will ask the mods to lock or delete this thread if this continues.

Damob

Hi Kegobeer,

Yep have tried tpcview, current port ,openport scanner and run a full HJT scan (all latests versions)

And nothing gives any associated ip !

New development and a overall solution:

Today it has started to open port 61958 UDP instead of the previous one !
I have ran a full virus scan with nod32, and it comes up with nothing.
And have disabled the only startup apps (iMon and soundmanager) and temporarily disabled all non essential services , and after that it still opens this port

So in the interest of my sanity, I have disabled UPnP and network discovery on this PC, which solves the problem but does not explain it. Which I find very annoying, but nethermind !

Many thanks for your input my friends.

Damob

PS if I do suddenly have a brainwave and find what is doing this I will update the post so that others don't go through the same shenanigans.

Have you checked the Windows Event Log for messages such as:

UPnP Action: 'AddPortMapping' from IP=x.x.x.x (Success)

If so when are these messages logged?

Since this is a clean install of Windows have you tried disabling the SSDP Service?
If not try that and see if the issue persists.

I'm wondering if this is somehow related to teredo...

BTW I don't know anyone in their right mind that enables UPnP, it's such an easy technology to exploit from the internet if it's enabled on your router. Since UPnP doesn't support any authentication it almost makes it a breeze to change router configs from the internet without the need for any router logon credentials.

@DC187

No can't find any mention of UPnP Port mappings in the event log, I tried searching for the string you mentioned and have searched manually.

With SSDP and UPnP device host services disabled it does not pop up on my router.
So at the moment this is how I have left it.

Yeah I know what your saying about UPnP being weak, but I do have good reasons to use it. And from everything that I have read up on it, it seems that the most common point of attack is via remote code execution through java and other types of browser add ins. Thankfully I have not used MS Internet Destroyer for over a decade at home, I use Opera with java, and script blocking and don't tend to click on any old thing on the web :)

@logicearth

Ok lets just scratch all of this and start again. As I think we are just splitting hairs here and getting far too deep into the inner workings of transport protocols.
You believe that I am wrong and I feel that some of what you have said is incorrect or misleading, however I do understand and agree with some of what you are saying.
But we could be going on ad infinitum and for no real purpose, so lets just shake hands and agree to disagree on some points

Although on your point on http connections going out on port 80 but coming back on a random port designated by the client.
As far as I understood the system or subsystem,the client sends a request on port 80 and then listens on the same port, I know of but don't fully understand the principles of RCP over TCP which I am aware uses higher range upd port numbers for running other low level services.
I am not an expert on this so will leave it at that


I also do have to admit that as I have not done much reading up on the new 7 home groups and network discovery and SSDP , I was unaware of how much this is tied into UPnP.
So I was wrong by saying Windows OS's don't use UPnP for it's own purposes, as now with Windows 7 this is the case. so hands up on that one !

As mentioned above I have now disabled SSDP and UPnP client discovery and that has stopped the offending item from making a connection, and all other functions of the OS are working correctly so it is definitely not an essential OS function.
And the 3 other programs that I have installed are all working correctly.

So basically what ever it was it is not doing it now so I am happy :)

Thank you all ,for all of your input.


Best Regards

Damob