remote access software...

[jon12]

Trustwave scanned our network and found this, out of 7 computers on the network, 5 are using this "UDP port 500" im trying to figure out what program is using that port...

 

[samuria]

You will struggle as UDP doesn't connect were tcip it connects and traffic goes back and forth UDP just send hello and there is no reply even if it's an open port. Any programming can use any port so there is no way of saying what it is. The main use of this port is to connect to VPN anyone using VPN?

 

[jon12]

You will struggle as UDP doesn't connect were tcip it connects and traffic goes back and forth UDP just send hello and there is no reply even if it's an open port. Any programming can use any port so there is no way of saying what it is. The main use of this port is to connect to VPN anyone using VPN?

thx for your reply, no one is using vpn, do i need to worry about our computers being hacked?

 

[samuria]

As there is no connection it's safe but they are ipv6 unless your using home group disable it as it's not used for anything else

 

[jon12]

As there is no connection it's safe but they are ipv6 unless your using home group disable it as it's not used for anything else

im not using homegroup... disable homegroup or ipv6 or both?

 

[samuria]

ipv6 homegroup wont work without it so need to remove it. You may like to look at this site CurrPorts: Monitoring TCP/IP network connections on Windows they have lots of free toolto track down were the udp is coming from

 

[jon12]

thanks

 

[Alejandro85]

According to the List of TCP and UDP port numbers, port UDP 500 is, by standard, assigned to "internet key management protocol and IPSec", which is a very legitimate use of a local network (basically a security protocol defining access rules). If it's a work network as I think, it may be very well intended and therefore completely normal. Also note that the listening program is "svchost", which belongs to a built-in Windows service.

On the other hand, I would have to ask, what is that "Trustwave" to begin with?
I wonder how it concluded that you have a "remote access service" at all, or even if it's malicious or not. I would be wary of those results, and analyze them first before alarming.

 

[jon12]

Thx for your reply. Trustwave is an information security company that works with our credit card processor. Trustwave scans our network every month for vulnerabilities.