[unisog] Messenger port 1900 to my router

Mayne, Jim J.Mayne at tcu.edu
Fri Jan 16 17:26:19 GMT 2004


Steve,
  Great. Thanks.

Jim

Jim Mayne 
Network Security Engineer 
Texas Christian University 
j.mayne at tcu.edu 
(817) 257-6843

 


-----Original Message-----
From: Steve Bernard [mailto:sbernard at gmu.edu] 
Sent: Friday, January 16, 2004 11:14 AM
To: Mayne, Jim
Cc: unisog at sans.org
Subject: Re: [unisog] Messenger port 1900 to my router


Mayne, Jim wrote:

> Steve,
>   Sure PnP. I am not sure what was I thinking? Anyway my question is 
> that as you indicate and as what I have read would indicate it should 
> use a multicast address but instead it is sending directly to the 
> gateway's unicast ip address. That just seems wrong.
> 
> Thanks,
> 
> Jim
> 
> Jim Mayne
> Network Security Engineer
> Texas Christian University
> j.mayne at tcu.edu
> (817) 257-6843
>  
> 
> 
> -----Original Message-----
> From: Steve Bernard [mailto:sbernard at gmu.edu]
> Sent: Thursday, January 15, 2004 2:35 PM
> To: Mayne, Jim; unisog at sans.org
> Subject: RE: [unisog] Messenger port 1900 to my router
> 
> 
> You can disable this on Windows XP by changing a registry key. A value

> of '2' turns off the multicast traffic.
> 
> Key: HKLM\Software\Microsoft\DirectPlayNATHelp\DPNHUPnP
> Type: REG_DWORD
> Value: 2
> 
> 
> Regards,
> 
> Steve Bernard
> George Mason University
> Fairfax, Virginia
> 
> 
> 
> -----Original Message-----
> From: Mayne, Jim [mailto:J.Mayne at tcu.edu]
> Sent: Thursday, January 15, 2004 9:03 AM
> To: unisog at sans.org
> Subject: [unisog] Messenger port 1900 to my router
> 
> 
> I am not very familiar with the Messenger protocol but I am seeing a 
> constant traffic from my windows machines to port 1900 of my routers 
> internal interfaces. It is always the default gateway address of the 
> windows machines. From what I could tell Messenger should be sending 
> to a multicast address not the unicast address of the gateway. Is 
> something going on here?
> 
> Thanks,
> 
> Jim
> 
> Jim Mayne
> Network Security Engineer
> Texas Christian University
> j.mayne at tcu.edu
> (817) 257-6843
> 
> 
> 
> 
> 

Jim,

I've seen both views expressed but the solution is always the same. What

I see here is packets destined for port 1900 on the local gateway 
(unicast) address.


Steve



More information about the unisog mailing list