Routers

So CrazyM i dont have to worry then? do you know what SSDP, the only info i get is that its something to do with remote installation software.

 

It could just be wanting to install an update for your google homepage.

 

From the logs you have posted, I would say you have nothing to worry about. Just late packets being dropped and logged. It appears from your quote of my previous response it was prior to my edit.

SSDP has nothing to do with that particular log entry. It is only mentioned in the log entry because it is commonly associated with port 1900. As I tried to explain some software when logging port information will also list the name of the service commonly associated to a port. This can be misleading and confusing, as in this case, as SSDP had nothing to do with the event being logged. You mention using Norton, and NIS/NPF have this bad habit.

Regards,

CrazyM

 

still having problems with the router, but the Active x was to do with spybot S/D trying to start up a deleted java active x. all sorted now!!!

Thanx again,

Maze

 

What sort of problems?

Regards,

CrazyM

 

hi,

CrazyM

At the moment ive changes my hompage and blocked active x,m which seem to have sorted any problems out. so i m pretty happy at the moment.

 

CrazyM one thing i was abit concerned about is the router icon always shows disabled in the connections part of windows?

 

Is your router UPnP capable and if so, is it enabled?

Regards,

CrazyM

 

yes, this happens quite often !

If these are not connections that you have started then
this means that if you are running NAT, then your router is hacked.
Or you already had portforwarding on.

First thing you have to do, is check if your router can be configured from
the WAN interface.

In lots of cases you can configure a router from the WAN interface if you connect to a certain port.
A small webserver is running in the router, that pops up a username and password.

If you leave those on their factory setting this is of course VERY UNSAFE
and the most common way a router is hacked.

If someone can log in to the router it can forward al the ports he likes,
and attack your computer(s).

The ip numbers of the router can easally be found in the routers ARP table.

Best way is to DISABLE the routers configuration interface ONLY ON THE WAN interface

Disable all port forwarding that you don't need.

Are you running a webserver behind this router perhaps?

have to go now sorry ....

 

- CrazyM why do you ask for?. at the moment i only get connections come through and show on my software firewall when i download security updates. I that normal?