[unisog] Messenger port 1900 to my router

Mayne, Jim J.Mayne at tcu.edu
Thu Jan 15 22:48:35 GMT 2004


Steve,
  Sure PnP. I am not sure what was I thinking? Anyway my question is that as you indicate and as what I have read would indicate it should use a multicast address but instead it is sending directly to the gateway's unicast ip address. That just seems wrong.

Thanks,

Jim

Jim Mayne
Network Security Engineer
Texas Christian University
j.mayne at tcu.edu
(817) 257-6843
 


-----Original Message-----
From: Steve Bernard [mailto:sbernard at gmu.edu]
Sent: Thursday, January 15, 2004 2:35 PM
To: Mayne, Jim; unisog at sans.org
Subject: RE: [unisog] Messenger port 1900 to my router


You can disable this on Windows XP by changing a registry key. A value of
'2' turns off the multicast traffic.

Key: HKLM\Software\Microsoft\DirectPlayNATHelp\DPNHUPnP
Type: REG_DWORD
Value: 2


Regards,

Steve Bernard
George Mason University
Fairfax, Virginia



-----Original Message-----
From: Mayne, Jim [mailto:J.Mayne at tcu.edu]
Sent: Thursday, January 15, 2004 9:03 AM
To: unisog at sans.org
Subject: [unisog] Messenger port 1900 to my router


I am not very familiar with the Messenger protocol but I am seeing a
constant traffic from my windows machines to port 1900 of my routers
internal interfaces. It is always the default gateway address of the windows
machines. From what I could tell Messenger should be sending to a multicast
address not the unicast address of the gateway. Is something going on here?

Thanks,

Jim

Jim Mayne
Network Security Engineer
Texas Christian University
j.mayne at tcu.edu
(817) 257-6843






More information about the unisog mailing list