I don't think it's Messenger. Messenger use port 1863. The 1900 port is the "new Win XP feature" : UPnP.
Just ignore those alerts. Regards Herve -----Message d'origine----- De�: Michael R. [mailto:[EMAIL PROTECTED]] Envoy�: lundi 28 janvier 2002 15:34 ��: Mike Burden; [EMAIL PROTECTED] Objet�: Re: [gb-users] MSN Messenger Filter Blocks Mike, WindowsXP Installs MSN Messenger by default, and it is a tricky lil guy to get rid of. Located here [ http://www.tweaktown.com/document.php?dType=guide&dId=120&dPage=4 ] is a tweak guide that shows you how to uninstall MSN, otherwise every time a user starts up outlook MSN will pop up, and try to connect. Michael Rhing Global Technology Associates, Inc. 3505 Lake Lynda Drive Suite 109 Orlando, FL 32817 USA Tel: +1.407.380.0220 x1223 Fax: +1.407.380.6080 http://www.gnatbox.com ----- Original Message ----- From: "Mike Burden" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, January 28, 2002 9:21 AM Subject: RE: [gb-users] MSN Messenger Filter Blocks They are hitting the PRO interface from private addresses. This virtually guarantees that they are coming from your own computers. Odds are that either some of your users are trying to "chat" using MSN Messenger, or else someone has installed some Microsoft software that installed MSN Messenger (Anyone know if the latest release of IE installs MSN Messenger?) IMHO this would be a safe bet to put on the ignore list. You need to create an outbound filter that denies access from ANY_IP to ANY_IP port 1900 (the destination port from the block message). Mike Burden Lynk Systems http://www.lynk.com (616)532-4985 [EMAIL PROTECTED] > -----Original Message----- > From: Mike Ayers [mailto:[EMAIL PROTECTED]] > Sent: Monday, January 28, 2002 9:14 AM > To: [EMAIL PROTECTED] > Subject: [gb-users] MSN Messenger Filter Blocks > > > We are getting a steady stream of filter blocks on the protected > interface as shown below. They are apparently coming from MSN > Messenger. Does anyone know if these packets constitute a security > risk? And if not, which filter do I need to modify to stop logging > this? > > -------------------------------------------------------------- > ---------- > ----- > NOTIFICATION TYPE: GNAT Box FILTER ALARM > CONFIGURATION: PROTECTED=192.168.0.1 > -------------------------------------------------------------- > ---------- > ----- > ALARM NO: 1 > DATE: Monday, Jan 28, 2002 > TIME: 07:58:27 > INTERFACE: PRO (rl0) > ALARM TYPE: Block > IP PACKET: UDP [192.168.0.227/1218]-->[192.168.0.1/1900] l=132 > > > > Thanks, > > _____ > > Mike Ayers > [EMAIL PROTECTED] > > --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] To subscribe to the digest version first unsubscribe, then e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] To subscribe to the digest version first unsubscribe, then e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] To subscribe to the digest version first unsubscribe, then e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
