Reply to thread

Message

<blockquote data-quote="Mr Whippy" data-source="post: 1260449" data-attributes="member: 164120">Did you figure this out?<a href="https://www.darkreading.com/new-ddos-attack-method-leverages-upnp/d/d-id/1331799" target="_blank">New DDoS Attack Method Leverages UPnP</a>But if that isn't the case...If you close the firewall on a client/server machine, MP2 client and MP server do have a lot of blocked traffic on UDP 1900 to 239.255.255.250 (UPnP / SSDP)Within about 1 minute of closing the firewall, I have about 300 connection attempts each from the client and server for the UPnP connection.In your case it sounds like the server/client connections fail for some reason, and then MP just starts using UPnP to find/connect to machines, but it now can't... so it just keeps flooding the network with UPnP traffic.With multiple clients/servers I can see how the traffic volume could get pretty high.In the time I've written this post MP2 programs have generated over 4000 connection attempts through my firewall to UPnP, and that's just loopback on a local machine setup.I'm not sure what the specific issue in MP might be, if there are any at all. I'm somewhat surprised if UPnP best practice is to just flood a network perpetually looking for machines to connect together.Personally I think MP2 is handling UPnP a bit wrong somewhere. At my end I run a closed outbound firewall with rules, and no matter what I specify (except 'open' outbound globally) MP2 will fail to get it's UPnP traffic past the firewall (even with explicit rules, generalised rules etc)All it's other traffic however is fine with explicit rules. It's *just* the UPnP traffic that keeps getting blocked.I'm doing more testing to see what it might be.</blockquote>

[QUOTE="Mr Whippy, post: 1260449, member: 164120"] Did you figure this out? [URL="https://www.darkreading.com/new-ddos-attack-method-leverages-upnp/d/d-id/1331799"]New DDoS Attack Method Leverages UPnP[/URL] But if that isn't the case... If you close the firewall on a client/server machine, MP2 client and MP server do have a lot of blocked traffic on UDP 1900 to 239.255.255.250 (UPnP / SSDP) Within about 1 minute of closing the firewall, I have about 300 connection attempts each from the client and server for the UPnP connection. In your case it sounds like the server/client connections fail for some reason, and then MP just starts using UPnP to find/connect to machines, but it now can't... so it just keeps flooding the network with UPnP traffic. With multiple clients/servers I can see how the traffic volume could get pretty high. In the time I've written this post MP2 programs have generated over 4000 connection attempts through my firewall to UPnP, and that's just loopback on a local machine setup. I'm not sure what the specific issue in MP might be, if there are any at all. I'm somewhat surprised if UPnP best practice is to just flood a network perpetually looking for machines to connect together. Personally I think MP2 is handling UPnP a bit wrong somewhere. At my end I run a closed outbound firewall with rules, and no matter what I specify (except 'open' outbound globally) MP2 will fail to get it's UPnP traffic past the firewall (even with explicit rules, generalised rules etc) All it's other traffic however is fine with explicit rules. It's *just* the UPnP traffic that keeps getting blocked. I'm doing more testing to see what it might be. [/QUOTE]

Verification