Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Blacksmith]

Has anyone else seen this: IDS proto parser : udp null port (1 of 2) : 192:xxx:xxx:xxx xxx:xxx:xxx:xxx

The first address is my own PC whereas the last address is external and always the same. My router event log is peppered with these entries and I'm curious as to what triggers them.

[Mick]

Tell us what the external IP address is in case we can deduce something from it, or look it up for yourself using any online whois tool.

[kitz]

IDS =  Intrusion Detection System on your routers firewall
"UDP null port" in this instance is the protocol analysis signature.


The firewall contains many different types of signatures.. (eg scan signatures/Denial of Service signatures/Protocol signatures etc) each of which identify different types of attacks or probes, in order to protect your network against intrusion.

Signature in this instance meaning the way a particular type of hack (or virus or trojan etc) works and behaves and how its identified.
To help aid understanding further - Anti-virus programs contain large lists of Virus signatures which are used to protect your PC.  When the AV detects a program or file that has the same signature (pattern of behaviour) it will then report the signature so that you know which particular type of virus it is.

Back to IDS - When an attack or probe has been detected then your firewall reports it in the router log.
So basically all that its telling you is that it detected (and dealt with) some sort of intrusion attempt whose signature is or resembles the "udp null port" type of attack that was coming from that other IP address.

Do you use p2p type software by any chance?

[Blacksmith]

Tell us what the external IP address is in case we can deduce something from it, or look it up for yourself using any online whois tool.

It's 91.103.67.144

[Blacksmith]

IDS =  Intrusion Detection System on your routers firewall
"UDP null port" in this instance is the protocol analysis signature.


The firewall contains many different types of signatures.. (eg scan signatures/Denial of Service signatures/Protocol signatures etc) each of which identify different types of attacks or probes, in order to protect your network against intrusion.

Signature in this instance meaning the way a particular type of hack (or virus or trojan etc) works and behaves and how its identified.
To help aid understanding further - Anti-virus programs contain large lists of Virus signatures which are used to protect your PC.  When the AV detects a program or file that has the same signature (pattern of behaviour) it will then report the signature so that you know which particular type of virus it is.

Back to IDS - When an attack or probe has been detected then your firewall reports it in the router log.
So basically all that its telling you is that it detected (and dealt with) some sort of intrusion attempt whose signature is or resembles the "udp null port" type of attack that was coming from that other IP address.

Do you use p2p type software by any chance?

This machine has a clean install of Windows 7 RC running on it. No p2p - in fact, there are very few other pieces s/w installed except Firefox 3 and Kaspersky Internet Security 2009 - and I've Googled the WAN address to the Kaspersky forum (in Russian) so I suspect it may have something to do with KIS. I replaced AVG with KIS earlier this week so that would certainly explain the log entries.

[roseway]

>> It's 91.103.67.144

That IP address is owned by Kaspersky Lab, so the log entries relate to the operation of the Kaspersky Internet Security suite.

[kitz]

That is weird that it should be Kaspersky that is triggering something off in the router firewall.

afaik UDP null port is a scan for open and listening ports, but I dont know why it should be doing this outbound via the router.  I wonder if it downloads using a p2p type technology?

Ive just done a search and there seems to be a couple of others whom have noticed this behaviour from Kaspersky..  I also found this.

In there the OP lists the same kaspersky IP addy as being blocked after installing Kaspersky AV by his firewall.
Below that someone mentions "proacive defense which is checking the online database for whitelisted applications. it's not sending any personal data just check sums of the applications."

I do find it a bit weirded though that an AV type prog should be exhibiting the type of behaviour that triggers off a well known protocol analysis for IDS.

Theres a bit more about protocol analysis here

[Protocol analysis] focuses on reviewing the strictly formatted data of network traffic, otherwise known as protocols. Each packet is wrapped in predefined layers of different protocols. IDS authors, recognizing this, implemented engines that unwrap and inspect these layers, according to the protocol standards or RFC. Each wrapper has several fields with expected or normal values. Anything that violates or is outside of these standards is likely malicious. The IDS inspects each field of the different protocols of an incoming packet: IP, TCP, and UDP. If something violates a protocol rule, for instance, if it contains an unexpected value, an alert is generated. Protocol analysis uses a detailed knowledge of expected or normal packet field values to discover malicious traffic

The question I cant answer and what I find strange, is why something (kasperspy) is sending out udp packets that dont seem to adhere to the protocol standards

[Blacksmith]

Thanks to everyone for taking the time and trouble to reply to this query.

As you say, Kitz, it is rather odd that Kaspersky should be triggering an IDS event. Needless to say, a full scan of the hd threw up nothing but at least I can rest assured there's no malicious s/w behind this.`