topic Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and.... in Tech Help - Software/Hardware etc

UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Luzern — Tue, 27 Jul 2010 07:13:44 GMT

I have Windows7 Home Premium, Thomson 585v7 router. I am sole user and administrator, My computer is connected by Ethernet without network. I use Routerstats.
Lately I have noticed that the routers log has extremly frequent examples of
UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) .
These are accompanied by LOGIN User tried to login on [HTTP] (from 192.168.1.64)
My screen is full within the hour with the entries.
Can anyone tell me if this is usual and what the entries are for? Can the frequency of the entriesbe reduced or stopped? What risks would that raise?

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Peter_Vaughan — Tue, 27 Jul 2010 07:29:12 GMT

What is your systems IP address?
Do you have the wireless enabled on the router - if so, turn it off if you don't use it.

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Luzern — Tue, 27 Jul 2010 08:33:52 GMT

Hi there
Connection settings states " server assigned", currently.
This rocking horse is not sure how to switch off wireless on the 585.

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

BrianE — Tue, 27 Jul 2010 09:40:00 GMT

You'll probably find that 192.168.1.64 is the IP your router has assigned your computer - In that case, the `UPnP action 'AddPortMapping'` is nothing to worry about (probably), as it's just your computer telling the router it wants to be able to receive a certain port
Could be you've installed BitTorrent software that's used it to make your speeds faster, or something like Skype
Or, it could also be a trojan making life easier for whoever created it
If you've been using new software recently that uses the internet to communicate (like Skype / BitTorrent), you probably have nothing to worry about... Thuogh you might want to run a virus check, too, just in case

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Luzern — Tue, 27 Jul 2010 09:51:38 GMT

Point is though that it leaves no room for any important info that may be needed, soon lost.
No Skype or BitTorrent.
Will run virus check later today.

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

BenTrimble — Tue, 27 Jul 2010 09:56:17 GMT

Have a read about uPNP and you should find it's nothing to worry about.

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Luzern — Tue, 27 Jul 2010 17:11:27 GMT

Ben I haven't had chance to read the article fully but uPNP ilooks as you say from quick scan innocuous.
However, it's the amount of entries, that mean potentially more important events are discarded,that are the point of my OP

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Jaggies — Wed, 28 Jul 2010 01:25:56 GMT

Quote from: lucerne
uPNP ilooks as you say from quick scan innocuous.

If you aren't using uPNP just disable it in your router.

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Luzern — Wed, 28 Jul 2010 08:01:09 GMT

Hi Jaggies.
So easy: a lot of sites were saying it had to be disabled in Win7!!!

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Luzern — Wed, 28 Jul 2010 19:52:46 GMT

In my OP I mentioned the "LOGIN User tried to login on [HTTP]... [192.168.1.64]" entries that accompanied the UPnP action ones. The LOGIN events are still coming in spades, and also are not marked 'success'. I fail to see why there should be so many. Why are they happening still? Are they able to be turned off too? I do not recall seeing the entries, or there were far fewer, with my Netgear.
Coincidentally the connection dropped around 2.40 pm and reconnected at 1000kbps lower,
Coincidental?

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

BenTrimble — Thu, 29 Jul 2010 08:58:45 GMT

If there is any issue with logon attempts from the local network then it's a virus / spyware / malware issue.

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

hxa7241 — Sun, 24 Apr 2011 15:33:46 GMT

Regarding the profusion of: LOGIN User tried to login on [HTTPS] (from 192.168.1.64)
I have noticed this (with the TG585). I think it is the web-browser, and normal.
Every time you view a page of the router's web-interface your browser sends authentication to the router. You do not really login once at the start, but every time you view a page (the browser caches the username and password and resends them each time) -- that is how HTTP 'basic access authentication' works.
You can check this by opening your browser, viewing a few of the router pages, then closing the browser, then accessing the router with telnet and viewing the log (systemlog show): there should be a few of the 'LOGIN' messages just between the times you used the browser.
I do not know why the router bothers to show this when it is so useless in the usual case. But, strictly, it makes some sense.
Well, that is my conjecture on the matter based on observed evidence and available knowledge -- and it should be confirmable/refutable on those.

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

spraxyt — Sun, 24 Apr 2011 20:36:34 GMT

Is RouterStats using the admin account to access the router? Simultaneously logging in from your browser might confuse things.
I suggest setting up a second user for RouterStats to use. I think it needs admin privileges (or one step down) for access to the statistics pages. See if that reduces the number of login warning messages.