• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Sygate firewall messages

A

aic

Golden Member
What are these?

File Version : 5.1.2600.1106 (xpsp1.020828-1920)
File Description : NDIS User mode I/O Driver
File Path : C:\WINDOWS\System32\DRIVERS\ndisuio.sys
Connection origin : remote initiated
Protocol : UDP
Local Address : 192.168.0.255
Local Port : 137 (NETBIOS-NS - Browsing requests of NetBIOS over TCP/IP)
Remote Name :
Remote Address : 192.168.0.2
Remote Port : 137

Ethernet packet details:
Ethernet II (Packet Length: 110)
Destination: ff-ff-ff-ff-ff-ff
Source: 00-07-e9-c0-42-0f
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 64
Protocol: 0x11 (UDP - User Datagram Protocol)
Header checksum: 0x37f8 (Correct)
Source: 192.168.0.2
Destination: 192.168.0.255
User Datagram Protocol
Source port: 137
Destination port: 137
Length: 8
Checksum: 0xc070 (Correct)
Data (76 Bytes)



File Version : 5.1.2600.0 (xpclient.010817-1148)
File Description : Generic Host Process for Win32 Services
File Path : C:\WINDOWS\system32\svchost.exe
Process ID : 40C (Heximal) 1036 (Decimal)

Connection origin : local initiated
Protocol : UDP
Local Address : 192.168.0.2
Local Port : 1031
Remote Name :
Remote Address : 239.255.255.250
Remote Port : 1900 (SSDP - Simple Service Discovery Protocol)

Ethernet packet details:
Ethernet II (Packet Length: 175)
Destination: 01-00-5e-7f-ff-fa
Source: 00-07-e9-c0-42-0f
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 1
Protocol: 0x11 (UDP - User Datagram Protocol)
Header checksum: 0x8708 (Correct)
Source: 192.168.0.2
Destination: 239.255.255.250
User Datagram Protocol
Source port: 1031
Destination port: 1900
Length: 8
Checksum: 0xd29c (Correct)
Data (141 Bytes)
 
137 is netbios, 1031 is most likely IIS remote admin service. Block all netbios ports, and tell it to keep it out of the logs to prevent flooding.
Don't know what you do with IIS, so I can't say whether you want that closed.

If you have doubts about protocols just go to Google and type in: "<port number> port /etc/services" (without the quotes).
Example
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top