poort 1900

[Hazzz-E]

Wat doet dat, welke programma gebruikt het, waarom zou een user het gebruiken...

Deze vragen omdat ik net @guard hebt geinstalled. En er constant op deze poort binnenkomende verbinding zijn.

Ik heb de search gebruikt maar ben er niet echt veel wijzer van geworden...

[Verwijderd]

Op vrijdag 21 september 2001 21:07 schreef Hazzz-E het volgende:
Wat doet dat, welke programma gebruikt het, waarom zou een user het gebruiken...

Deze vragen omdat ik net @guard hebt geinstalled. En er constant op deze poort binnenkomende verbinding zijn.

Ik heb de search gebruikt maar ben er niet echt veel wijzer van geworden...

http://www.iana.org/assignments/port-numbers
ssdp1900/tcp SSDP
ssdp1900/udp SSDP

SSDP=Simple Service Discovery Protocol

http://www.sans.org/y2k/021301.htm
Matt, This article pointer was forwarded to you from the Microsoft Online Support site. http://support.microsoft.com/support/kb/articles/Q262/4/58.ASP

This link answers some the questions about where those thousands of udp 1900 frames are going. It seems Windows ME has built in SSDP (simple service discovery protocol) and UPNP (universal plug 'n play) (see http://www.upnp.org/). Specifically (from the Microsoft page):

Discovery - A Universal Plug and Play device advertises its presence on the network to other devices and control points by using the Simple Service Discovery Protocol (SSDP). A newly added control point uses SSDP to discover Universal Plug and Play devices on the network. The information exchanged between the device and the control point is limited to discovery messages that provide basic information about the devices and their services, along with a description URL, which can be used to gather additional information about the device.

Description - Using the URL provided in the discovery process, a control point receives XML information about the device, such as make, model, and serial number. In addition, the description process can also include a list of embedded devices, embedded services, and URLs used to access device features.

There's undoubtedly lots more going on here, but it looks like out-of-the-box installs of WinME w/ this auto-discovery to a multicast address have the potential to eat a LOT of bandwidth. There is also the real possibility that this process 1) already reveals more about a system and its peripherals than we would like and 2) may have the ability to be abused to initiate network mapping & intelligence gathering queries.

[Hazzz-E]

thanks, ik ga dit ff bestuderen...

en denk dat ik het voor nu ff block

[localhost]

Heee, die ken ik.

Windows XP wil direct na de installatie connectie maken met IP adres 239.255.255.250, poort 1900.

Volgens mij is dit een of ander Video/Multicast protocol ?

[Hazzz-E]

hmm, ik draai inderdaad ook winxp