What about this traffic alarms you specifically?

The 192.168.1.1:5390 -> 192.168.1.255:162 is SNMP, maybe an SNMP trap being
sent to your network's broadcast address (someone else can probably comment
more specifically). Check the configuration of the 192.168.1.1 device and
turn SNMP off if you're not using it.

The 192.168.1.1:1901 -> 239.255.255.250:1900 is "Universal Plug-and-Play"
traffic. The latter address is a multicast address reserved for this
purpose. It should remain local to your own network (i.e. not routed
through your Internet link).

205.152.37.254:53 is DNS for ns.asm.bellsouth.net (your ISP?).
129.6.15.29:123 is NTP at time-b.nist.gov, probably a time synchronization
tool running on 192.168.1.2.

None of this looks alarming to me, at first glance. What about it worries
you?

Though to be fair, there have been some vulnerabilities in the last few
months related to SNMP and UPnP, so that traffic alone might be reason to
take a closer look at your network, but I see no evidence of a compromise
just yet.

David

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]