[Dshield] Any ideas?

Mark Rowlands mark.rowlands at minmail.net
Fri May 24 18:03:58 GMT 2002

On Friday 24 May 2002 5:25 pm, van Niekerk Niel wrote:
> Hi,
> Here's the rub, I am seeing a fair amount of UDP broadcast traffic directed
> to  port 1900 (SSDP) these originate from many different hosts on our LAN
> (see the packet capture below), all the references I can obtain for SSDP or
> port 1900 points to either WinXP or MSN messenger.
> The captured packets certainly looks like SSDP packets inasmuch as they use
> HTTP over UDP, but nowhere could I obtain any reference to the "Info"
> option in SSDP... (however it is quite possible that I missed/misunderstood
> something somewhere)

> The question is this:
> Has any of the clever ppl on this list any ideas as to what this is/seen
> this before? I have a feeling this must be common on  WIN2K LAN's and not
> just something peculiar to our setup, but I cannot seem to find any
> reference to it...


More information about the list mailing list