I know I didn't set them up. I tried editing and disabling them but the router responds with Please enter a valid port value for the from value of incoming port!!. I got rid of them by loading ad previously saved configuration.
I did several Google searches but did not get good information one way or the other. I understand what it is (IPv4/IPv6 tunneling), but not how it got there. My router is password protected so I'd sure like to know how they got there, and how to get rid of them without having to load a previously saved configuration.
Edit: There were also 9 MSNMSGR entries which I also have no idea how they got there. I never check my router settings, so this is a warning to all, check yours regularly.
The only way I could get rid of all this stuff was to restore to factory settings then re-enter what I wanted.
Edit#2: The Dell 2350 does not support UPnP so I'm really stumped as to how these ports were forwarded.
TBH I am out of my depth when it comes to networking, at first look I was worried you may of got an infection on msn, but a quick search suggests it's not untoward and is to secure your system further, I use the OpenDNS settings under the IPv4 settings, but those look even deeper going, so sorry I can't help as such, but I hope this link allows you to figure out whats going on, my guess is it may be an m$ update perhaps that did this ?
Good luck in sorting it anyway. http://msdn.microsoft.com/en-us/library/bb968771(VS.85).aspx
That all applies to setting up Teredo (IPv4/IPv6) on your computer. It does not talk about setting the port forwarding in your router.
As I mentioned, as far as I can tell, the Dell 2350 Wireless Broadband Router does not support UPnP so there should be no way to do this programatically. It should require me to manually login to the router and setup the ports. This is what has me concerned.
I was wrong about the router supporting UPnP. I could find nothing in the documentation or via Google Searches, but looking through all the router menus, I found it, and it was enabled. That explains how the port forwarding settings were made, but not why.
[attachment removed]
I suspect the Toredo tunneling setup was done by CrossLoop but I'm not certain about that. Nope uninstalled and reinstalled CrossLoop and got no indication of an attempt to make a change to my router. It must have been something I installed sometime but I have no idea what it was.
Hi Rich,
I've had a look at my own Router WRT54GS LinkSys which is set up for both wired and wireless connection.
I have no information entered in port forwarding.
I browsed through all of the available settings to see if I could find anything similar to your "Teredo enable 56155 ~ 56155
192.168.2.11 ~ UDP"
Found nothing.
I have no idea where those settings came from.
I do not use Crossloop, but do know people who do use it.
I use LOGMEIN for remote access service to several machines.
I activated my LOGMEIN and logged into a remote machine.
No changes occurred in my Router Configuration when logging in or staying logged into the remote machine.
I doubt if any of the above is useful to your above diagnostic work.
Sorry.
I will load Crossloop to see if it requires any port forwarding if you wish.
Let me know.
Doug
Thanks Doug. See my last edit. I uninstalled and reinstalled CrossLoop, after disabling UPnP on my router and it installed and runs okay, so that is not the culprit.
Thanks again Rich,
I had read those articles, both of which provide useful information.
It appears to me that two or more possibilities arise in your situation
1. You intentionally installed a P2P utility such as uTorrent or Azureus, either of which would have automatically configured their own preferred port forwarding and usage priorities.
2. You've run afoul of a piece of malware with UPnP abilities which may have automatically configured your machine to broadcast and receive on their preferred ports …. for their purposes, not yours.
3. (or more)… you guessed it. I have no other ideas.
Doug
Why would router manufacturers have this on by default? Talk about OPEN SESAME
Well, as you have learned, simplicity is far preferred over security. Everything in our lives is designed to make our lives easier while sacrificing our security and privacy.
Its hard to say what software changed those ports. The answer, as you have already discovered, is to turn off uPNP.
If something configured port forwarding on your router, then it must also have setup a listening port on your computer that corresponds with the forwarded port or it would be useless.
How about running the netstat command and taking a look for anything listening on the ports in question?
The full command to use would be: netstat -abn <– Entered at the command prompt.
The above command will also display the executable file name associated with whatever is using a certain connection or listening on a certain port. It may take a minute while the system associates executable name with port number. If you are not dealing with malware, which can hide information listed in netstat, this command is valuable for determining what program is doing what on your network connection especially if you think there is a problem.
For example, I learned that there are certain websites, if left open on the computer, that will cause non-stop network activity. One of those is youtube.com. I found this out when I noticed that my computer was completely "idle," and started wondering why my internet activity was non-stop.
Didn't tell me much. I've already removed all the forwards from my router and disabled UPnP. If I remember correctly, all the MSNMSGR entries were disabled.
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1176
c:\windows\system32\WS2_32.dll
C:\WINDOWS\system32\RPCRT4.dll
c:\windows\system32\rpcss.dll
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ADVAPI32.dll
[svchost.exe]
If there was, you would've saw a program listening on one of the ports in question (you mentioned in your first post). But, I don't see anything here. Did you add the bold emphasis to the port numbers?
