Svchost.exe - IN - UDP - from Local Modem Router to Local Address....?

Comodo Internet Security - CIS Firewall Help - CIS
#1

Hi,

A couple of weeks ago I upgraded to Windows 8.1 and the last couple of days I get repeated messages in Comodo Log where it says …Svchost.exe - IN - UDP - from my modem router 192.168.1.1 via different ports to my local computer 192.168.1.4 via always the same port 56427.

Simultaneously it has also been an increased activity reported in the Log as …Svchost.exe - Out - UPD - local address 192.168.1.4 via always same port 56427 - to 239.255.255.250 with always the same destination port 1900.

Third there has been a request via ICMP to 239.255.255.250.

What picks up my attention is the “IN” from my local modem router. So I am wondering if this is some kind of attack from the outside where the originating ip-address is concealed by my modems internal address?

I someone could please enlighten me or give me some insights on what is really happening here I would very much appreciate it.

I have attached a picture of the log “…Svchost.exe - IN - UDP - from my modem router 192.168.1.1 via different ports to my local computer 192.168.1.4 via always the same port 56427”

Thanks,
Laurus

[attachment deleted by admin]

#2

That will be Simple Service Discovery Protocol (SSDP) and Universal Plug and Play (UPnP). :slight_smile:

#3

Thanks a lot for your prompt reply Kail.

I guess I know the answer, but that would mean that everything is perfectly ok. Right? :azn:

Thanks,
Laurus

#4

Yes, I believe it’s perfectly fine (normal). Of course, should you be so inclined, you can disable both SSDP and UPnP if you don’t use/need* them. :slight_smile:

*if you have LAN enabled printers, cameras and other such things that you plug-in often or might plug-in, then it’s probably best left alone.

#5

Thanks a lot for your help Kail :-TU