cancel
Showing results for 
Search instead for 
Did you mean: 
Taffia
Aspiring Contributor
471 Views
Message 1 of 6

Unknown port fowarding appearing in my HH3A

Go to solution

These two port forwarding entries have been added to my HH3A by something called TR064.

 

Does anyone know why ?.

 

My HH3A is connected by cat5e cable to port 5 of a netgear GS105. Another cable goes to my

PC from port 3 of the GS105 and my Samsung smart TV monitor is connected to port 1 of the

GS105.

 

Since I didn't add them, how do I remove them ?.

 

 

 Time and date                   Message

 

13:05:25, 25 Apr. (1017038.790000) Port forwarding rule added via UPnP/TR064. Protocol: UDP, external ports: any->49468,     internal ports: 49468, internal client: 192.168.1.67

 

13:46:57, 19 Apr. (501109.520000) Port forwarding rule added via UPnP/TR064. Protocol: UDP, external ports: any->51984, internal ports: 51984, internal client: 192.168.1.65

0 Ratings
Reply
5 REPLIES 5
Distinguished Sage
Distinguished Sage
463 Views
Message 2 of 6

Re: Unknown port fowarding appearing in my HH3A

Go to solution

They are being automatically opened by a game or application. This is because you have uPnP enabled on the home hub.

 

The devices that are doing this are at the IP adresses shown.

192.168.1.67

192.168.1.65

 

See what is running on those devices, as they are opening incoming connections. If you do no know what they are, then disable uPnP on the home hub, as it could be a security risk.

 

Taffia
Aspiring Contributor
448 Views
Message 3 of 6

Re: Unknown port fowarding appearing in my HH3A + multiple disconnects

Go to solution

Ok, disabled uPnP

 

I don't use wireless, so that is turned off too, but extra uPnP security was on as well anyway.

 

There are only three physical devices attached :-

 

Wall Socket -> HH3A -> Netgear GS105 ------> Win 7 32 PC

                                                    \-----> Samsung 22H5600 Smart TV

 

 

The TV has its own anti-virus of some sort, my PC has Kaspersky 2017. It had also loaded Kaspersky

Secure Connection which is OpenVPN. This seemed to have a mind of its own, so I have removed it.

 

In the event log I see that every 24 hours or so I also see these :-

 

19:12:15, 28 Apr.(87234.960000) DSL noise margin: 6.00 dB upstream, 6.00 dB downstream
19:12:14, 28 Apr.(87233.980000) DSL line rate: 1227 Kbps upstream, 17591 Kbps downstream
19:11:58, 28 Apr.(87218.410000) CWMP: session closed due to error: Could not resolve host
19:11:58, 28 Apr.(87218.330000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
19:11:58, 28 Apr.(87218.310000) CWMP: Session start now. Event code(s): '4 VALUE CHANGE'
19:11:28, 28 Apr.(87187.700000) CWMP: session closed due to error: Could not resolve host
19:11:27, 28 Apr.(87187.650000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
19:11:27, 28 Apr.(87187.640000) CWMP: Session start now. Event code(s): '4 VALUE CHANGE'
19:11:27, 28 Apr.(87187.080000) CWMP: Initializing transaction for event code 4 VALUE CHANGE
19:11:25, 28 Apr.(87185.090000) DSL is down after 1451 minutes uptime
19:11:25, 28 Apr.(87185.090000) ETHoA is down after 1451 minutes uptime
19:11:24, 28 Apr.(87184.690000) PPPoA is down after 1451 minutes uptime [Waiting for Underlying Connection (WAN DSL - Up)]

 

19:11:22, 28 Apr.(87182.060000) PPP LCP Send Termination Request [User request]

 

 

and every few minutes a stream of disconnect messages like these :-

 

19:11:12, 28 Apr.(87172.160000) Device disconnected: Hostname: udhcp-1-12-4-00- IP: 192.168.1.66 MAC:
19:11:12, 28 Apr.(87172.140000) Device disconnected: Hostname: udhcpc1-21-1-5c- IP: 192.168.1.65 MAC:
19:11:07, 28 Apr.(87167.160000) Device disconnected: Hostname: udhcp-1-12-4-00- IP: 192.168.1.66 MAC:
19:11:07, 28 Apr.(87167.140000) Device disconnected: Hostname: udhcpc1-21-1-5c- IP: 192.168.1.65 MAC:
19:11:07, 28 Apr.(87167.140000) Device disconnected: Hostname: Skyd IP: 192.168.1.64 MAC:
19:10:32, 28 Apr.(87132.170000) Device disconnected: Hostname: Samsung-22H5600 IP: 192.168.1.67 MAC:
19:03:57, 28 Apr.(86737.180000) Device disconnected: Hostname: Samsung-22H5600 IP: 192.168.1.67 MAC:
19:01:36, 28 Apr.(86596.500000) Device disconnected: Hostname: Samsung-22H5600 IP: 192.168.1.67 MAC:
18:59:36, 28 Apr.(86476.480000) Device disconnected: Hostname: udhcp-1-12-4-00- IP: 192.168.1.66 MAC:
18:59:36, 28 Apr.(86476.460000) Device disconnected: Hostname: udhcpc1-21-1-5c- IP: 192.168.1.65 MAC:
18:59:31, 28 Apr.(86471.480000) Device disconnected: Hostname: udhcp-1-12-4-00- IP: 192.168.1.66 MAC: 00:03:78:9c:8d:65
18:59:31, 28 Apr.(86471.460000) Device disconnected: Hostname: udhcpc1-21-1-5c- IP: 192.168.1.65 MAC: 5c:49:7d:7a:3a:d2
18:59:31, 28 Apr.(86471.460000) Device disconnected: Hostname: Skyd IP: 192.168.1.64 MAC:
18:59:18, 28 Apr.(86458.620000) SD-100 (1)

 

These groups of disconnect messages appear almost constantly every few minutes in groups like above.

 

udhcpc1-21-1-5c-xx-xx is the hH3A, I think.

 

Would the netgear switch have a device name ?. It is unmanaged so I thought it should be

transparent. Could it be Windows Media Player ?. I did have a brief foray into ripping

CDs and using WMP to try and allow me to listen to music on my Humax HD Fox T2

set top box, but that wont play flacs, only MP3 so I gave up. The Humax is not

connected at the moment.

 

Skyd is my PC

 

I don't use any games or streaming software software (Afaik).

 

Hope this helps.

 

taff

0 Ratings
Reply
Taffia
Aspiring Contributor
443 Views
Message 4 of 6

Re: Unknown port fowarding appearing in my HH3A + multiple disconnects

Go to solution

According to Devices and printers, my PC has an exclamation mark by its icon inside a yellow triangle.

 

When I click on it and the properties panel appears, on the hardware tab the top item

is "Teredo Tunneling Pseudo-Interface", and the status is "This device cannot start (Code 10)".

 

No idea what this means. It has only happened recently.

 

I guess I will have to revert to a single connection from HH3A to my PC and work

forward from there. I suspect it was Kaspersky secure connection, but I removed that

yesterday.

 

I have seen this (Code 10) on a USB interface on my card reader but not my PC. Wierd.

 

 

0 Ratings
Reply
Distinguished Sage
Distinguished Sage
442 Views
Message 5 of 6

Re: Unknown port fowarding appearing in my HH3A + multiple disconnects

Go to solution

You should now have lost the automatically mapped ports.

 

0 Ratings
Reply
Taffia
Aspiring Contributor
429 Views
Message 6 of 6

Re: Unknown port fowarding appearing in my HH3A + multiple disconnects

Go to solution

Hi Keith

 

The problem is I only saw them in the event log under "Port Forwarding", but if I choose that

option, I cannot see anything set up. So I still don't know what devices 192.168.1.67 and

192.168.1.65 relate to which means I don't know why these ports were set up.

 

Selecting the Port Forwarding option from A-Z under advanced settings and choosing

"Select device" I can still see four devices, even though only two physical boxes are

connected (ignoring HH3A and GS105 switch):-

 

My PC

Samsung Smart TV

udhcp-1-<MAC address ending in 65>

udhcpc1-<MAC address ending in d2>

 

I'm still not sure the last two are.

 

At least I have fixed the Teredo Tunnelling Pseudo stuff. Lots of hits with google, but no

explanation as to why it is such a frequent problem with so many people.

 

Thanks anyway.

 

0 Ratings
Reply