Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[z_one]

Hello,

I just noticed this message in my TG 585 v7 modem log.

ALG Protocol: UDP Open port: 7648 Helper: CU/SeeMe => ok

Can anyone tell me what it means please ? Is it a security breach ?
I don't use the CU/SeeMe software and it's not installed on my machine. I have Windows 7 firewall turned on and my modem's firewall is set to "standard".

Also what does "Use Extended Security" in the "Game and Application Sharing" page mean ?

I tried to disable UPnP and the modem restarted ? How come ?

Thanks in advance for the replies.
_________________________

**Edit:
I found the following information from a PDF document titled "Thomson Gateways and UPnP".

UPnP Features
To summarize what has been explained in the previous chapters, a UPnP Internet Gateway Device allows you
to:

• Connect/disconnect the Internet connection.
• Create NAT entries.
• Get statistics about the Internet connection, from a remote interface.

Extended Security (default setting) - UPnP is enabled with the following limitations:

• Write mode option “NAT only”: only NAT actions are allowed remotely (i.e. creation, deletion). The
  gateway cannot be connected/disconnected via UPnP.
• Safe NAT option “enabled”: A control point can only create NAT entries for himself onto the gateway
  device (e.g. not possible to open a door towards an other device available inside the LAN).
  

[kitz]

CU/SeeMe => ok

It appears to be some sort of video conferencing that seems legitimate.   Do you have a webcam, have you ever used any chat software?
You may not have actually installed chat software on your PC as some chat channels can use browsers. 
Having used uPnP it may well have autoconfigured any port forwarding it needed to be able to work.

Once upon a time there were concerns about UPnP, but most of the issues have been ironed out.  I would say that the majority of todays routers have UPnP enabled without problems.

I tried to disable UPnP and the modem restarted ? How come ?

Most routers will need to restart after certain configurations have been changed.  Its nothing to worry about

 

[z_one]

It appears to be some sort of video conferencing that seems legitimate.   Do you have a webcam, have you ever used any chat software?
You may not have actually installed chat software on your PC as some chat channels can use browsers. 
Having used uPnP it may well have auto-configured any port forwarding it needed to be able to work.

Once upon a time there were concerns about UPnP, but most of the issues have been ironed out.  I would say that the majority of todays routers have UPnP enabled without problems.

Thank you for the reply.
To answer your questions: I don't have a webcam, I never installed/used any video conferencing software and the only chat I use is Facebook's built in chat.
But according to the event log, it seems as if someone was re-configuring the modem remotely ? I could be wrong.

Most routers will need to restart after certain configurations have been changed.  Its nothing to worry about

So if I re-enable UPnP and check the "Use Extended Security" I should be safe ?

On a lighter note, this is a very nice forum you have here. I have been reading posts for quite some time but just registered yesterday.

[burakkucat]

   Hmm . . . Trying as hard as I can, I shall attempt to comment without disagreeing with 'Our Leader'. 

UPnP -- I would suggest leaving it turned off unless it is essential for the correct operation of a device on your LAN.

You might like to test your modem/router using the GRC Instant UPnP Exposure Test with UPnP first disabled and then enabled.

[z_one]

Thanks for the reply.
I tested with UPnP both enabled and disabled and got the following result:

The equipment at the target IP address did not respond to our UPnP probes!

[kitz]

Trying as hard as I can, I shall attempt to comment without disagreeing with 'Our Leader'.

heh thats fine b*cat, always happy to be corrected.   I know there are still a few security issues with UPnP but afaik the usual stuff like not allowing viruses from the inside to blow open the network and you 'should' be ok, and most of the major/common issues have been plugged.  As far as Im concerned UPnP is a godsend for the average user who just doesnt have a clue how to port forward correctly and there are some who have difficulty setting things like webcams up even with UPnP

But according to the event log, it seems as if someone was re-configuring the modem remotely ? I could be wrong.

I dont honestly know either, but logged events are often failures.  Its not uncommon for users to be concerned when looking at router security logs and seeing lots of attempts being logged.

The UPnP check I use for windows systems is
http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp

[burakkucat]

I tested with UPnP both enabled and disabled and got the following result:

The equipment at the target IP address did not respond to our UPnP probes!

A good result.

[z_one]

A good result.

Thanks , I ended up disabling UPnP though as everything on my PC is working fine without it.