Use google about PORT 1900 to learn more.
System: HP a362n, 3GHz, 2G RAM (hardware drivers current)
Network: Comcast Broadband (no perforamnce issues on speed tests)
Cable Modem: RCA (no errors)
Router: Cisco WRT54G2 (no errors, updates current)
Nic: RealTec Ethernet
OS: XP Home Edition 2002, SP3 -- MS updates current
Firewall: Norton Internet Security (NIS)
AV: Norton, p/o NIS
MS Defender active.
MS Firewall not active.
Sorry for the long back story, but leads to where I am now, so I thought it might help in answering the actual questions.
I was looking at TeamView client and saw it was the most popular remote support software by CNet downloads, while on their site I ran the light client TeamViewQS.exe to get an idea of what the client side would look like. I don't think it is related to this, but worth mentioning as it is what has lead me to asking about it.
There were so many great reviews, I failed to look at the 8 bad reviews out of over 500 that rated it a 5. After seeing that it looked just right for my need, I decided to read the bad reviews before installing the TeamView Host, these 8 were not kind at all and claimed to brought their machines under attack as soon as they installed it. So I did not install the full TeamView.
Concerned the fast client may have done something, I opened Nortons History to look at the Firewall Activity, and noticed that 15 times a minute, consistantly, I get and inbound UDP packet trying to get to port 1900, the Norton Firewall rule blocks it.
Actions since discovering this in the Norton log:
- Full system Virus scan w/latest signatures
- System Restore to the point before I tried the TeamView Client
- Reviewed System Logs though the event viewer -- Nothing unusual in any of the logs, Security Audits all passed.
- Reviewed Defender Running Programs, nothing out of place
- Reviewed Start-up Programs (Through Defender and TUT) all good
- From cmd box, ran ipconfig /release then /renew
- Verified I got a new IP address
- Alert stopped in NIS Firewall Logs for a few minutes then started again. (meaning a few minutes after the full boot to where the system was idle)
TUT = The Ultimate Troubleshooter, slightly larger claim than what it does obviously
From SystemInternals, TCPView output on this:
Process / Protocol / Local Address / Remote Address / State
svchost.exe:1996 / UDP / zzz-zz.zzzz.ss.comcast.net.:1900 / *:* / blank
svchost.exe:1996 / UDP / zzz-zz:1900 / *:* / blank
The state for both is blank, it is not listening or anything else.
Where zzz-zz is my machine name and ss is the state I live in and they are correct.
Given that the NIS firewall is blocking this but I have no issue with my service, I am not sure why comcast is listed or why they might be trying to hit that port every 4 seconds, if that is what it means?
Norton Internet Security Message -- In the log it has "info" status.
Info -- Rule "Default Block UPnP Discovery" stealthed (xxx.xxx.1.1, Port ssdp(1900). Inbound UDP packet. - Date & Time - Status: Detected -- Action: None required. Blocked.
Advanced Details (NIS Label):
Category - Firewall - Activities
Rule - "Default Block UPnP Discovery" stealthed (xxx.xxx.1.1, Port ssdp(1900). Ibound UDP packet.
Local Address, service is (188.8.131.52, Port ssdp(1900) ).
Remote Address, service is (xxx.xxx.1.1, Port(2240) ).
Process Name is "C:\WINDOWS\system32\svchost.exe".
Looking at my TCP/IP Port Connections I see this listed:
Local IP: xxx.xxx.1.104 (my IP address after the renew)
Local Port: 1900
Remote IP: blank
Remote Port: blank
Remote Host Name: blank
State: blank (for other things it is Listen or Established...)
Q1. Does any one know why I would be getting this attempt to reach this UDP Port 15 times a minues, every 4 seconds?
I have no issues with internet performance, system performance, no errors in any logs, passed full system scan.
Q2. If this is from Comcast, should I allow this in NIS and in Defender?
Q3. If NIS is blocking this every 4 seconds I would think just the logging alone must be nipping some performance, even if I am not seeing it, so if I allowed it from Comcast, should I make explicit to them and still block all others? This would stop the blocking and logging for anything but Comcast.
Q4. I noticed when I brought up Network Setup Wizard by mistake instead of Network connections, that MS Defender detects an attempt to make a registry change to enable the port by the same instance of svchost.exe, to which I can pick Allow or Deny. I did not go into the Set-Up Wizard, just the do you want to panel at the start up of it.
Is this needed for anything if my network is already set-up and running?
Q5. Should I block this at my router, and if so, what exactly should I set up to block?
Thanks for any info, I hunted around and got all kinds of answers but no "theme" so I have no idea which one is right, except that it is a network discovery service similar to PnP for hardware, auto-detection and config of network stuff?
Some say disable it, it is a network discovery service XP starts but is not needed, others say it is other PC's on my Comcast network "loop" doing some kind of broadcast, and others say never disable it or you will have issues and the list of the alleged issues vary from person to person.
So I am hoping the right answers are here, again thanks and sorry for the long read.
I did google it, and that is where I got so many mixed answers.
Bottom line question I guess is do I really need this?
If not, should I block it at my router?
I don't want mystery network issues down the road after I have long forgotten that I have it disabled on the firewall.
You link pointed it being realted to MS Messenger, which I have disabled using a tool I got from here, well CNet Downloads, been like that for years now, I don't use any IM's on this particular PC.
Is this ogrinating from my PC/OS, Router, or is this traffic coming in from the outside?
I try to do the leg work before asking anything here, in this case it lead to just more confusion, but no shortage of hits on google. I also rummaged all over my system for the info for the question. Not trying to be lazy here, but there is a LOT of noise on this topic, and I trust CNet forums info more than most places, so I came here hoping to get the real answer, if there is one.
I had to use a similar discussion to find not only the messenger service but all the addins. The link I supplied noted this.
But I fear you want the silver bullet to fix this. Given only the port number I can't guess that it is anything other than the normal cause. And many are overtaxed when we ask them to look at addins.
Let's say this. It is normal for this port to see traffic like that. What made you think it was bad?
I only noticed it when I went to the Norton Firewall log after reading member reviews of TeamView here and how it started a lot of traffic coming their way, they did not describe it in detail.
There were only 8 of over 500 reviews that said things along this line but I still thought it might be worth a look, so I started to hunt around and looked in the NIS firewall log and saw them coming in at 15 a minute.
Then when I searched on it there was a wide range of inconsisant answers, and a lot of the material was heavily dates, such as from 2001 or 2005, some 2008, but even current info was not clear, nor the microsoft site that only describes the function, but no insight as to what it might impact for the average joe.
At this point I am not even 100% sure it is originating from the internet, it could be the router, or the service on my PC. It does say inbound and I see nothing about outbound.
I also don't see any attempts to connect to Port 5000 in any logs or while actively looking at all connections, if I read the MS tech blerb right the UDP broadcast with a starting octet of 239 and going for UDP port 1900 is looking to negotiate a TCP connection on Port 5000. That the firewall is blocking likely explains why there is no history of TCP Port 5000 being used.
Now it is just one of those things that will keep bugging me until I can figure it out, plus, blocking and logging an action every 4 seconds must be taking some resources that if not needed I would like to have back.
I am generally open to do what it takes if I can get a kick in the riht direction and what to do and what to look for.
While the messages are still coming in at the same rate and being blocked by NIS, if you drill far enough in to the actual NIS Firewall rule there is a logging option, I just turned it off. No real difference in anything, but at least it is not writing that alert to the log anymore.
Small win, but I take what I can get at each step...
Chasing it down from what was using it lead to ActiveSync, at least what was starting it, ssdp was set to manual at the service level.
Per TUT they suggest just leaving it on as it discovers most devices on your network and configs them, like the router. Also by Messenger and WMP Media Sharing, neither of which I use.
So I guess for me the answer is leave it on and leave it blocked, if something needs it inbound, I can make an exeption to the rule. I just keep the logging killed for that source.
You were right, there was no silver bullet, and it is not really clear to my why it needs to be running if it is blocked, but I'll leave well enough alone for now, TUT recomendations are usually pretty good.
It looks like wcescomm fires up the SSDPSRV, once it fires up it looks like he is doing the polling, I don't have my phone or PDA plugged in now, so I would not think activesync itself is doing anything, wcescomm in one hour of monitoring had mem fixed at 5.68MB and 0 cpu in the hour. (I say looks like because I am trying to connect the dots between what I see in TUT processes and task tabs, the dependancy drill downs, with what I see in TCPViewer and ProcessMonitor so I could easily not be interpreting the information wrong...)
SSDP takes 0.93MB and just blips CPU, but I used the link to task function and it lead back to one of the instances of scvhost, which blips every now and then, not every 4 seconds, so whatever cpu it is using is hard to catch but it does not look like much. What a maze.
When I plug in my PDA and as comes to life, wcescomm does a quick 30% CPU hit and drops to 10%, then sort toggles between 0 cpu and little spikes of 10% a few times here and there, no real pattern, even doing nothing.
I do have Activesync configured to provide a path to the internet for my my phone or PDA when connected. I am wonding if that makes it treat it like a PNP network device and thus invokes SSDP services to "discover" and config the network access...
If I stop SSDP the one thing I am sure, is the messages to UDP Port 1900 stop instantly, so no doubt who is doing now. Still wonder why they look like Inbound messages to NIS?
Not an expert answer, just info.
Been researching if my PC has been hacked recently. Here is food for thought and a direction to look. UDP Port 1900 is the Univ Plug & Play port. It seems mfrs have left this port open from the 'outside' and hackers are now using it to hack our systems. I have a guy in Bulgaria accessing my system and the net now tells me I am operating from Charleston, SC.
I understand we need to let UP&P work on the inside of our networks, we can connect printers, etc. However, there is supposed to be no reason to allow UP&P request from 'outside' your network.
This may all be in the wind a little, but it is something and maybe a qualified user can put some light on this.
Is that if you have the typical internet and router, all unsolicited traffic is dropped at the router so for almost everyone there is no issue here.
However if you port forward or put a machine into the DMZ then you did open that up to attack.
Sorry but for most this issue is a non-issue.
This one tip will help you sleep better tonight
A few seconds are all you need to get a better night's rest.