OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Rich Adamson (radamsonrouters.com)
Date: Wed Apr 03 2002 - 05:32:04 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    We're seeing a few internal workstations (behind a firewall) originating
    packets with the contents like:

     "SEARCH * HTTP/1.1 HOST 239.255.255.255:1900<crlf>MAN "ssdp:discovery"<lf>
     MX: 3<crlf>ST: urn:schemas-upnp-org:service:WANIPConnection:1<crlf>

    The packets were observed being sent to the workstation's default gateway
    (happens to be a Bay BLN router) with a destination port of udp-1900, as
    observed with an NAI Sniffer. The router is not configured to support
    multicasting.

    Anyone seen these or have any idea what might be generating the query/scan?

    _______________________________________________
    Snort-users mailing list
    Snort-userslists.sourceforge.net
    Go to this URL to change user options or unsubscribe:
    https://lists.sourceforge.net/lists/listinfo/snort-users
    Snort-users list archive:
    http://www.geocrawler.com/redir-sf.php3?list=snort-users