[FIREWALL] 239.255.255.250 port1900 SSDP

if you are on Windows 2000 / XP / 2003 server
vaccinate your PC with Windows Worms Doors Cleaner below:
http://www.firewallleaktester.com/tools/wwdc.exe

Thank you for this information, there are few responses on the subject with the searched IP, my ZA has blocked it but with no further information...
Now I know, at least that

Furthermore, I went to the mentioned site http://www.grc.com
very good, full of useful tools, but in English, a pity for those who are averse to English.

Well done for your clear and precise post.

Hello,

I can't help you... but I've noticed exactly the same thing on my PC.

Actually, I didn't have a FW and after installing ZA last weekend, I saw there was an outgoing access request from explorer.exe to the address 127.0.0.1 (I was told that was normal) but also another one (outgoing) to the address 239.255.255.250.

I found it strange and blocked the access. It doesn't prevent anything from running. So for me, it's sorted out, but I'm curious to know what it is.

See you later

I'll surely read the rest of the story.

dead laughing if you want to block IP addresses from Diana I have a good trick, just unplug your cable.
Otherwise, I don't know where you're looking for your information............ I suggest you start from the beginning before trying to act like an expert, a few networking classes.

What is it? Well, here's the thing:

A UDP request aimed at recognizing plug-and-play hardware on the network in unicast and multicast, at least from what I understand.

https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol ;-)

--
A wise penguin is worth two...

I didn't fully understand everything but I can block it from passing through the firewall.. What should I do? And if you could summarize it in "plain" terms, lol, to explain to me what it corresponds to, as for the exe given above, is it safe?
Thank you for your response.
Best regards,
Bidi.

Hello everyone, I'm on Debian, and I'm sniffing the network with Wireshark. I've noticed this same address communicating with my router, using the SSDP protocol as you indicated.
My router and this address are exchanging packets at regular intervals, and during these exchanges, my connection slows down to the point where I can't load any pages. In fact, it's so slow that it's not enough for my browser to return an error, so I do have internet, but my bandwidth seems to be completely reserved by these exchanges. I have disabled UPnP on my router for now. I'm going to sleep and I'll address this properly tomorrow.
I wanted to know if you are experiencing the same symptoms.
See you soon +++

Well, well, well, what is it with these people who, with their contemptuous tone, reveal their weaknesses? ...Indeed, I also advise them to take a network technician training course...They will also learn that speaking is not about despising, but discussing, so that we can all agree on a problem to solve it together...It's true that with Windaube, just going to websites about Linux...or others..Assedic, anpe..all the sites the government is trying to take control of (that's just my humble opinion ;-)..after all, France is the first dictatorial country of the internet in the world...Equality, brotherhood...and your sister? Is she churning butter?
Peerguardian flashes at everything if you want to gather information on Mesrine or Sarkozy, as if they were from the same family..Between us, I prefer Mesrine......But there's a solution: get into computing, not DIY..Xubuntu is wonderful!
Come on, be happy..It's the weekend!
Kisses to all, my dear brothers, my dear sisters.... ;-)

Well this little exe ...!

Thank you for this little adjustment in the register too!

Do you happen to have an Xbox 360??? XD

Waw, that's a lot of talk :)

So, the first message explaining the problem is quite funny. It made me think of an expert speaking in a "know-it-all" tone while actually knowing nothing and being afraid of network packets :D.

I have this problem too, that's how I stumbled upon this post. In 2 minutes, you can quickly understand that it's a protocol (a bunch of network device jargon) that exists solely to discover services (like a "hello, I'm a friend" ..). It's also mentioned that it's some uPnP thing .. Okay .. I don't have Windows at home, so I find it funny when I see people recompiling DLLs .. um .. they need to stop watching the experts ^^.

In my case, and I'm pretty sure, disabling the UpNp thing on my ADSL router, my WiFi bridge, and my switch (which is nothing but a WRT54G v7 .. a piece of junk) should definitely stop this kind of broadcast.

So, stop flashing, no, it's not a virus, no, your PC is not going to get kidnapped ^^. It's just a network device looking for a friend. Disable this function on the router in question, and everything will be back to normal ;).

+ 10,000!

happy to have reached the bottom of the page before shutting down the internet completely in a second! :) lol in clear terms and for the dummies please,

_when there are 2 PCs at home with "file and printer sharing" desired, upnp? yes/no?

_when DL >>> upnp? yes/no?

basically the user Landa (if such a thing exists) >>> office/games/web/DL/2 PCs (maybe) .... >>> upnp? yes/no?

I blocked it, I didn't really look for the warehouse in Moldova that was making the request, because everything works without it, but if it's useless for the uses described above,

I am a staunch advocate of "eradicating the unnecessary" so please!!! :)

It's great, a topic 3 years old ;-p

I have never read anything so stupid: going to modify the DLLs with a hex editor to fix a problem that we don't understand.
Me, who isn't a mechanic for two cents, I took apart the alternator of my car. Indeed, all those copper wires... it scared me.
After a few kilometers, the car stopped. I wrote to Renault; they still haven't replied. But I know what it is: it's the electronics. Always broken on these damn cars!! And not even a patch to update. What a bunch of incompetents!!

UPNP on port 1900 is not only local network, it can also go out to the internet, proof that Look n' stop blocks ALL remote IPs, and by sniffing we can verify it.

Oh dear...
Especially don't do what was suggested above.

Instead, go to Wikipedia which will tell you that this address is used by the SSDP protocol to discover, for example, printers, and that it is an address that will not leave your local network.
"239.0.0.0/8 Site multicast address. These serve the same purpose as private addresses, their dissemination is limited to a site."
As for the University of California, I must admit I had a good laugh about a private address (which therefore belongs to no one except IANA, the organization that "manages" address allocations and is indeed based in the USA).

So, no risk, and if we want to avoid these frames, we need to get rid of UpNp.

The request for access to address 239.255.255.250 port 1900 upnp is triggered if in Explorer > Network Favorites (if Win XP) you click on "show network device upnp icons" (network printers, network hard drives, network scanners, etc., connected via the router). Then your computer will want to browse the network looking for these devices and thus go through the famous address of your router. If you do not want these icons of your devices to appear, do not click on "show icons..." or if you have already clicked on it, click on it again (in this case "hide icons" will appear) and you will no longer receive access requests to 239.255.255.250 port 1900. There you go, the rest is just philosophy or... humor (really enjoyed the dismantling of the alternator from the Twingo!)