UDP warning

Follow

Michael Bierman

• April 02, 2020 22:15
• Edited

I keep getting the following alarm from my wife's MacBook Air.

UDP Port 5353 on device CG-LB is open to public permanently for PCP MAP 7f54ece3581abc53007142ee.

I can't figure out what is opening this port. Sometimes the port is open for a short period of time. The PCP MAP changes frequently if not every time. I notice that port 4500 is sometimes used instead.

1. Anyone know what is likely to be causing this? 
2. What kind of rule can I write to block it?

None of the other devices on my network trigger this alert. 

Also, Yesterday I created a rule that blocks Device UDP Port 5353 for this MacBook always but I am still seeing the alerts. 

0

• 

  Bob O'Hara

  • April 02, 2020 22:29

  Port 5353 is used by Bonjour

  0

  Comment actions Permalink
• 

  Michael Bierman

  • April 02, 2020 22:30

  Thanks, Bob. I know that but I don't know why that Mac and no others are triggering this so I wasn't sure if it was Bonjour. 

  0

  Comment actions Permalink
• 

  Jim Berube

  • April 03, 2020 01:30

  Wouldn’t it be a good idea to turn off UPNP in your router, so no outside ports would be automatically opened?

  1

  Comment actions Permalink
• 

  Michael Bierman

  • April 04, 2020 19:11
  • Edited

  Thanks for the suggestion, Jim. I turned off UPNP on the router and ran malwarebytes on the computer in question which showed suspicions software. The combination has prevented any alarms at least so far. Thanks for the suggestion.

  0

  Comment actions Permalink

Please sign in to leave a comment.