Last time, after installing Windows Live 2011, I have a problem. Always after login to system CIS asking me about incoming connection from port 59060 or 59495 or some from range 50000 to 60000. Connection is established by “svchost.exe”.
Command line “netstat -a -b” shows that this connection is created by service SSDPSRV (part of Windows UPnP). What rule i should create for this issue? Port always random in range 50000 to 60000.
P.S.: I not want to create full trust rule for svchost because it is opens full access to LAN for all services. Can i create rule on some service hosted by svchost? (if netstat can show worked service on host than CIS can do it too).