Ports listening? 1

[GUJUm0deL]

HI all, I am using ZoneAlarm PRO on my WinXP Pro. According to ZA "Generic Host Process for Win32 Services Listening to Ports: TCP 5000 and UPD 1900" - is that normal?

I did a google search and it says Port 5000 is a backdoor used by malicious software to pass sensitive info. If those ports are not supposed to listening to, how do I turn them off?

I am using a Linksys Wireless-G broadand router (Model WRT54G)

Thanks!

____________________________________
Just Imagine.

http://www.imajinarts.com

 

[Rick998]

Hi,

This behaviour is normal... but concerns about XP's uPnP service (which listens for TCP connections on port 5000 and for UDP packets arriving on port 1900) were raised quite some time ago as a possible attack vector.

Have a look at Steve Gibson's article at

http://www.grc.com/unpnp/unpnp.htm

for detailed information plus a utility to disable uPnP.

Hope this helps...

 

[linney]

Sounds like this is the SSDP Discovery Service in action.


5000 TCP SSDP legacy event notification SSDP Discovery Service
1900 UDP SSDP SSDP Discovery Service


832017 - Port Requirements for the Microsoft Windows Server System

http://support.microsoft.com/default.aspx?scid=kb;en-us;832017&FR=1&PA=1&SD=HSCH

Description of Universal Plug and Play Features in Windows XP

http://support.microsoft.com/kb/323713

http://www.google.com/search?q=SSDP...ft:&ie=UTF-8&oe=UTF-8&startIndex=&startPage=1

 

[Rick998]

Oops... I forgot to add:

Have a look at the commandline 'DiamondCS OpenPorts v1.00' (a port-to-process mapper for NT/2K/XP available from

http://www.diamondcs.com.au/openports/).

This freeware utility shows you all open TCP and UDP ports on your system, including owner processes.

If any owner process shows just as a ProcessID in OpenPorts' then Nir Sofer's freeware 'CurrPorts' utility (available from

http://www.nirsoft.net/utils/cports.html)

will show you what process is using what ProcessID.

Hope this helps...

 

[GUJUm0deL]

I'm a bit confused, how is this a uPnP or SSDP?

I thought I would be able to simply disable this port from listening. I looked at the articles but i'm no netwrok admin so I got sorta lost in the "guide".

____________________________________
Just Imagine.

http://www.imajinarts.com

 

[GUJUm0deL]

Rick998, the link to disable the UPnP didn't work, so I did a google'd it and got

http://technology.msb.edu/training/network/pnp/index.htm

I safely disabled it...now what?

____________________________________
Just Imagine.

http://www.imajinarts.com

 

[Rick998]

uPnP is the same as SSDP... just two different ways of describing the same discovery service.

You asked in your original post 'how do I turn them off?'. Now you've disabled the service, that's it. You don't have to do anything else.

Hope this helps...

 

[GUJUm0deL]

Yup, that did help. Just outta curiousity is there a legitimate reason to have UPnP enabled? Esp if this poses a secururity risk. Does this mean Vista has this service disabled?

____________________________________
Just Imagine.

http://www.imajinarts.com

 

[Jito463]

Certain software can use uPnP to automatically open necessary ports on routers that support this feature. This can be a good thing, but can also be a liability. Hence the warning about it. There are other uses if I'm not mistaken, but this is the one I'm primarily aware of.

 

[GUJUm0deL]

So if I desable UPnP and then I have a software that tries to open it up (for legitimate reasons) will I get a prompt asking me if this OK or will it be denied? And, assuming I allow this one instance is the UPnP opened up permanatly until I once again turn it off?

____________________________________
Just Imagine.

http://www.imajinarts.com

 

[linney]

Have another read of the article.

Description of Universal Plug and Play Features in Windows XP

http://support.microsoft.com/kb/323713

Once disabled it is so until you enable it. You would either get a Prompt, or the Device will not work (or rather not be discovered) if it requires the Service.


This although more related to Vista, gives you some idea or what might require the Service from time to time.

SSDP Discovery

http://speedyvista.com/services/SSDP_Discovery.php