Showing results for 
Search instead for 
Do you mean 

UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Highlighted
Rising Star
Posts: 1,942
Thanks: 20
Registered: ‎31-07-2007

UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

I have Windows7 Home Premium, Thomson 585v7 router. I am sole user and administrator, My computer is connected by Ethernet without network. I use Routerstats.
Lately I have noticed that the routers log has extremly frequent examples of
UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) .
These are accompanied by LOGIN User tried to login on [HTTP] (from 192.168.1.64)
My screen is full within the hour with the entries.
Can anyone tell me if this is usual and what the entries are for? Can the frequency of the entriesbe reduced or stopped? What risks would that raise?
12 REPLIES
Community Veteran
Posts: 14,469
Registered: ‎30-07-2007

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

What is your systems IP address?
Do you have the wireless enabled on the router - if so, turn it off if you don't use it.
Rising Star
Posts: 1,942
Thanks: 20
Registered: ‎31-07-2007

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Hi there Smiley
Connection settings states " server assigned", currently.
This rocking horse is not sure how to switch off wireless Embarrassed on the 585.
Grafter
Posts: 29
Registered: ‎22-07-2010

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

You'll probably find that 192.168.1.64 is the IP your router has assigned your computer - In that case, the `UPnP action 'AddPortMapping'` is nothing to worry about (probably), as it's just your computer telling the router it wants to be able to receive a certain port
Could be you've installed BitTorrent software that's used it to make your speeds faster, or something like Skype
Or, it could also be a trojan making life easier for whoever created it  Undecided
If you've been using new software recently that uses the internet to communicate (like Skype / BitTorrent), you probably have nothing to worry about... Thuogh you might want to run a virus check, too, just in case Wink
Rising Star
Posts: 1,942
Thanks: 20
Registered: ‎31-07-2007

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Point is though that it leaves no room for any important info that may be needed, soon lost.
No Skype or BitTorrent.
Will run virus check later today.
Community Veteran
Posts: 2,106
Registered: ‎06-02-2008

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Have a read about uPNP and you should find it's nothing to worry about.
Rising Star
Posts: 1,942
Thanks: 20
Registered: ‎31-07-2007

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Ben Smiley I haven't had chance to read the article fully but uPNP ilooks as you say from quick scan innocuous.
However, it's the amount of entries, that mean potentially more important events are discarded,that are the point of my OP
Community Veteran
Posts: 1,556
Thanks: 2
Registered: ‎29-06-2010

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Quote from: lucerne
uPNP ilooks as you say from quick scan innocuous.

If you aren't using uPNP just disable it in your router.
Rising Star
Posts: 1,942
Thanks: 20
Registered: ‎31-07-2007

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Hi Jaggies. Cool
So easy: a lot of sites were saying it had to be disabled in Win7!!!
Rising Star
Posts: 1,942
Thanks: 20
Registered: ‎31-07-2007

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

In my OP I mentioned the "LOGIN User tried to login on [HTTP]... [192.168.1.64]" entries that accompanied the UPnP action ones. The LOGIN events are still coming in spades, and also are not marked 'success'. I fail to see why there should be so many. Why are they happening still?  Are they able to be turned off too? I do not recall seeing the entries, or there were  far fewer, with my Netgear.
Coincidentally the connection dropped around 2.40 pm and reconnected at 1000kbps lower,
Coincidental?
Community Veteran
Posts: 2,106
Registered: ‎06-02-2008

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

If there is any issue with logon attempts from the local network then it's a virus / spyware / malware issue.
Newbie
Posts: 1
Registered: ‎24-04-2011

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Regarding the profusion of: LOGIN User tried to login on [HTTPS] (from 192.168.1.64)
I have noticed this (with the TG585). I think it is the web-browser, and normal.
Every time you view a page of the router's web-interface your browser sends authentication to the router. You do not really login once at the start, but every time you view a page (the browser caches the username and password and resends them each time) -- that is how HTTP 'basic access authentication' works.
You can check this by opening your browser, viewing a few of the router pages, then closing the browser, then accessing the router with telnet and viewing the log (systemlog show): there should be a few of the 'LOGIN' messages just between the times you used the browser.
I do not know why the router bothers to show this when it is so useless in the usual case. But, strictly, it makes some sense.
Well, that is my conjecture on the matter based on observed evidence and available knowledge -- and it should be confirmable/refutable on those.
Community Veteran
Posts: 8,371
Thanks: 118
Fixes: 13
Registered: ‎06-04-2007

Re: UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

Is RouterStats using the admin account to access the router? Simultaneously logging in from your browser might confuse things.
I suggest setting up a second user for RouterStats to use. I think it needs admin privileges (or one step down) for access to the statistics pages. See if that reduces the number of login warning messages.
David