Snort UpnP Alert on Ubuntu

[OtagoHarbour]

I am using Ubuntu 11.04 and have just started using Snort!. (I installed the latest version of Snort! a couple of months ago.) When I run the following Snort! command

sudo snort -d -c /etc/snort/snort.conf -h 192.168.1.0/24 -l /etc/snort

I get the following output.

[**] [1:1384:8] MISC UPnP malformed advertisement [**]
[Classification: Misc Attack] [Priority: 2] 
01/21-20:18:02.413927 192.168.1.1:1900 -> 239.255.255.250:1900
UDP TTL:4 TOS:0x0 ID:0 IpLen:20 DgmLen:360 DF
Len: 332

(This is posted by references to web links which I cannot post since I am a new member.)

I followed the references and it appears that this is mainly a Windows problem and I am using Linux. However I do not think that I need UPnP and it appears to be a security risk. So I would like to disable it but have not found a good explanation about how to disable it, at least on Linux. I would be most grateful if someone could tell me how to do so.

Thanks,
Peter.

[lenfried_ga_suki]

You could just block it with iptables. UPnP runs on UDP port 1900 and TCP port 2869 according to Wikipedia.

sudo iptables -A INPUT -p tcp --sport 2869 -j DROP

sudo iptables -A INPUT -p udp --sport 1900 -j DROP

Then make sure you save those rules.

[OtagoHarbour]

You could just block it with iptables. UPnP runs on UDP port 1900 and TCP port 2869 according to Wikipedia.

sudo iptables -A INPUT -p tcp --sport 2869 -j DROP

sudo iptables -A INPUT -p udp --sport 1900 -j DROP

Then make sure you save those rules.

Thank you for your reply. Is that likely to block UDP or TCP packets other than those associated with UPnP?

Thanks very much,
Peter.

[lenfried_ga_suki]

No, I don't think so. Especially since you're not using Windows. I looked up those ports, and it appears that the only services that run on them are Microsoft services.

SSDP, which is specifically for UPnP, runs on UDP 1900, and ICSLAP, which is for Windows network sharing, runs on TCP 2869.

ports.my-addr.com/tcp_port-udp_port-application-and-description.php?port=2869
ports.my-addr.com/tcp_port-udp_port-application-and-description.php?port=1900