Firewall Alert

[Burrens78]

I keepo getting the following alert with Kerio:

The port usually ranges from 10334-10345 (if I am not mistaken).
Don't know what this service is doing, and don't know whether I should keep denying it, or create a rule to allow it.

Any insight helps. Kind of a newb, when it comes to ports and networking.

Thanks


[2/18/2005 4:00:15 PM]

Direction: incoming
Local Point: 0.0.0.0, port 5000
Adapter: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
Remote Point: 192.168.0.1 [192.168.0.1], port 10342
Protocol: TCP

Application path: C:\WINDOWS\System32\svchost.exe
Description: Generic Host Process for Win32 Services
File version: 5.1.2600.0 (xpclient.010817-1148)
Created: 2001/8/23, 12:00:00
Modified: 2001/8/23, 12:00:00
Accessed: 2005/2/18, 21:25:31

RuleId = 1275069233

 

[n0cmonkey]

What is 192.168.0.1? What is listening on port 5000?

 

[Burrens78]

192.168.0.1 is my router.

 

[n0cmonkey]

Is anything listening on port 5000 (netstat -an)? What is it?

 

[Burrens78]

Oh man, how do I find that out?

 

[n0cmonkey]

Download fport.

 

[Burrens78]

PID: 1436

svchost.exe

 

[imported_FishTaco]

Universal Plug and Play listens on port 5000 (TCP) and 1900 (UDP). Unless you have a need for Universal Plug and Play, you should disable it. Stop then disable the SSDP Discovery Service and disable the Universal Plug and Play Device Host.

 

[Burrens78]

Doesn't MSN Messenger use uPnP, as well as other software?

What else uses Universal PLug and PLay that I should look to see if I have?