OSTU: How to Start a Broadcast Analysis - Part Two (Tony Fortunato)

© 2009 www.thetechfirm.com

Examining

How to start a Broadcast Analysis

Part 2HTTP

Tony Fortunato, Sr Network SpecialistThe Technology Firm

http://www.thetechfirm.com/


Why Bother

Broadcasts can cause;

Network slowdowns

Rebooting or Frozen PC’s

Unreliable WIFI

Unpredictable application or window client performance

Extra ‘space junk’ that you need to sift through when troubleshooting



Common Networks and Related Issues In this typical network I look for BROADCAST HTTP traffic. What the heck would that be for??? Good old SSDP/UPNP is the answer.



Sources of these Broadcasters

Almost anything can send out UPnP/SSDP broadcast packets Printers PC’s Internet cameras



So What??? On December 2001 Microsoft stated that Universal Plug And Play (UPnP) in

Windows XP posed a security threat to ALL XP users!!! The threat was so bad that Scott Culp, Manager of Microsoft's Security Response

Centre said, "Every Windows XP user needs to immediately take action" and it was a "Very serious vulnerability."

Microsoft has issued a security bulletin MS01-059 that explains the issue in more detail



Now what? How do I find it, since even non-microsoft devices can send these out?

Protocol Analyzer is the easiest tool to use to clean this up. Start a capture from a PC and set a Stop Capture Trigger at 1 MB with a capture file

of “udp port 1900” (without the double quotes) Lets review the trace file



What’s out there? Since our capture filter is only targeting UDP PORT 1900, go to Statistics->Endpoints

and select the IP tab.

Perfect, here’s our hit list of 12 devices to clean up



UPnP Device Cleanup Most devices I have come across have a UPnP/SSDP configuration screen



PC Cleanup With Windows XP, simply uncheck the UPnP user interface under

Add/Remove Windows Components. Networking Services In most cases, you can uncheck Internet Gateway Device Discovery…. as well

Or directly from the Services screen, or scripts, or Policies, you get the idea



Tony Fortunato, Sr Network SpecialistThe Technology Firm

Examining

How to start a Broadcast Analysis

Part 2HTTP



For additional educational videos on Open Source Network Tools, please click on the following …

http://www.lovemytool.com/blog/ostu.html

LoveMyTool.com – Community for Network Tools


http://www.lovemytool.com/blog/ostu.html