Wilders Security Forums  

Go Back   Wilders Security Forums > Official ESET Support Forum > ESET Home Users Products Forum > ESET Smart Security
User Name
Password
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

 
 
Thread Tools Search this Thread
  #1  
Old February 25th, 2009, 11:34 AM
annakova annakova is offline
Infrequent Poster
 
Join Date: Feb 2009
Posts: 7
PixelPup UPNP getting blocked?

I am running ESS under windows XP SP3 on a computer attached to a home network that also has a separate music server and a music player attached. When setting up ESS on my computer, I checked "Allow UPNP in trusted Zone" and things basically worked OK. But then I started getting a bunch of these messages in the log:

Time: 5 times every minute
Event: Communication allowed by rule
Source 10.0.0.6:1900 (That's my music server)
Target: 239.255.255.250:1900
Protocol: UDP
Rule Name: Allow UDP traffic from musicserver

And then every ten minutes I get:
Time: 11 times in 3seconds, every ten minutes
Event: Communication denied by rule
Source 10.0.0.2:50003 (That's my router)
Target: 239.255.255.250:1900
Protocol: UDP
Rule Name: Block incoming SSDP (UPNP) requests

so these long series of log messages are logging traffic from my router and music server. I figured UPNP was somehow getting blocked, so I looked again and the "allow UPNP in trusted zone" was still checked. But I unchecked it and then checked it again, and these logging messages stopped. But a few days later they started up again, and I did the same thing and they stopped again.

So is ESS somehow resetting itself without updating the "allow UPNP" flag? Maybe when the program modules update or something?

Also, I looked in the list of rules, and there are two rules evidently entered automatically by the system that block TCP and UDP traffic on port 1900 for all addresses of all applications. This are set even though I have checked "allow UPNP in trusted zone".

Can someone explain what is going on here? (And despite the logging traffic, the music server <---> player connection keeps working, So really, I just want to know what ESS is logging here.)

Thanks,
Anna
  #2  
Old February 25th, 2009, 01:10 PM
funkydude's Avatar
funkydude funkydude is offline
Incredibly Massive Poster
 
Join Date: Apr 2004
Posts: 6,019
Default Re: UPNP getting blocked?

Hello Anna, are you by any chance running old firmware on the router? Is so, try updating it.

If not, wait until the issue happens again, then try rebooting the router instead of changing ess settings. Did that fix the issue?
__________________
OpenDNS with DNSCrypt

SSD: Windows 8 Pro x64 | IE10 (Enhanced Protected Mode) & Fanboy's TPLs
HDD: Xubuntu 12.04 LTS (x64) | Firefox: ABP(Fanboy's list) & HTTPS Everywhere
  #3  
Old February 25th, 2009, 05:48 PM
annakova annakova is offline
Infrequent Poster
 
Join Date: Feb 2009
Posts: 7
Default Re: UPNP getting blocked?

Thanks - I haven't touched the router since i bought it three years ago. I'll see if there is new firmware and give it a try.

Anna
  #4  
Old March 1st, 2009, 09:48 PM
annakova annakova is offline
Infrequent Poster
 
Join Date: Feb 2009
Posts: 7
Default Re: UPNP getting blocked?

Well, I found the latest firmware (2.1.5) for my Zoom X6 modem/router and upgraded it. It fixed the problem I had been having, but it introduced some major connection problems where my music player would just stop after 15 minutes or so and when I tried to get it restarted, I just got the error message that it couldn't find the server. So I went back to the earlier firmware(1.0.6). Oh well... the music is more important than a clean firewall log...

Anna
  #5  
Old March 1st, 2009, 10:17 PM
funkydude's Avatar
funkydude funkydude is offline
Incredibly Massive Poster
 
Join Date: Apr 2004
Posts: 6,019
Default Re: UPNP getting blocked?

Thanks for the reply Anna. Considering the massive leap in version number between the old and new firmware, I would seriously advise you to keep the latest for security reasons.

The problem with the music may be solved alternatevely, or may even be caused by something else.

Is the music hosted on a local server you stream to your pc? If so, make sure you are allowing sharing on the network in your ESS settings, and that it's not on strict protection.

You can also try making sure your music player isn't in the list of web browsers, and if it is, click the box until an X is in it(exclude).

Also you can enable the maintain inactive TCP connections in the firewall settings.
__________________
OpenDNS with DNSCrypt

SSD: Windows 8 Pro x64 | IE10 (Enhanced Protected Mode) & Fanboy's TPLs
HDD: Xubuntu 12.04 LTS (x64) | Firefox: ABP(Fanboy's list) & HTTPS Everywhere
  #6  
Old March 2nd, 2009, 07:38 AM
annakova annakova is offline
Infrequent Poster
 
Join Date: Feb 2009
Posts: 7
Default Re: UPNP getting blocked?

Thanks. Theoretically, I think my music traffic does not touch my Windows XP computer that is running ESS. I have a separate server (no keyboard or monitor, running Linux which I know nothing about) wired to the router, and then have a wireless connection from the router to a Logitech Squeezebox that plugs into my stereo system. That setup has generally been very solid, impressively so, (although who knows what the linux box is doing with my router..).

So as far as I understand, although my Windows computer running ESS is wired into that router, it shouldn't be involved in any of the actual music/radio streaming activity which goes Server - wired to router - wireless to Squeezebox. That streaming works just fine even when my computer is turned off. So I assumed all that log traffic involving my server and Squeezebox that I had been seeing on the Windows+ESS computer is from some form of UPNP discovery going on that wasn't working properly due to ESS.

The router firmware upgrade interfered somehow with the Squeezebox <--> Router <--> Server connection that had been working fine. I don't have much control over those two devices, so I can't really investigate that much further. I do have a web browser interface to the router but not much control there over whatever kind of firewall protection is going on in the router.

So while I like your suggestion to keep the newer router firmware update, I'm sort of at a blind wall about fixing the music connection that it breaks.

Anna
 

Wilders Security Forums > Official ESET Support Forum > ESET Home Users Products Forum > ESET Smart Security « Previous Thread | Next Thread »

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Settings
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -4. The time now is 05:44 AM.


Powered by vBulletin® Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2013, Wilders Security Forums