I got a pop up on this a few times now. Not sure what to do . Earlier today I read through some posts here and one said system should only have outgoing set, so I went ahead and set system and svchost in Comodo Firewall for outgoing only.
Could this possibly be something suspicious?
These are probably SSDP event notifications from your router. For UPnP/SSDP to work correctly, you should allow these, but it probably won’t cause any considerable problems if you continue to block the requests. Your choice.
I’m dealing with the same thing here (I think) but I’m not sure why it’s happening as it’s pretty recent.
I do have UPnP enabled, and my modem is a Cisco DPC3825 Gateway.
I switched to ComodoDNS and am wondering if it’s got something to do with that.
My first alert was svchost.exe trying to connect to 57058. I blocked that for a while, but did end up allowing it once. After that I started seeing system trying to connect to 2869. I’ve been blocking it as I’m not sure exactly what it is. Should it be ok to allow?
The DNS service will connect outbound via UDP to port 53 and the addresses used, last time I looked, were:
Other than that, svchost, along with other system services, use ports from the dynamic range (49152-65535) for a variety of things, so we’d need more information to determine the precise nature of the connection.
With regard to the SSDP/UPnP connection, these are typically event notifications, basically, just a UPnP enabled device, letting other similar devices, know it’s alive. If you’re using UPnP you should probably allow the connections, but it’s worth making sure you know where the connections are coming from.
Ok I will do that.
Any idea why that would just start happening?
It finally stopped after 214 log entries.
All I did was remake the rules I had deleted (from other thread).
Not really sure if that’s what fixed it though.
Source Port kept changing… went from 1099 up to 1129.
All other info stayed the same.
View Active Connections showed a connection to 126.96.36.199:80 (after the alerts stopped… may or may not be related).
As I mentioned earlier, these log entries just show SSDP event notifications. Generally, these are in response to a query, sent out by some other UPnP enabled device on your network. On a PC, svchost usually takes responsibility for UPnP/SSDP related connections. If you’re using default firewall rules, svchost is allowed to make outbound connections, so seeing your inbound connections as a response, is not really surprising.
If you’re not using UPnP, in addition to disabling the option in your router, you can open services.msc from Start/Run and disable the UPnP and SSDP services.
View Active Connections showed a connection to 188.8.131.52:80 (after the alerts stopped... may or may not be related).
Unlikely, the address belongs to GoDaddy, so this is probably a certificate check. Just another normal part of the OS connectivity.