Virgin Media Community

[vikstar100]

I have had five letters regarding multicast dns vulnerability.  I have written to them today and see what they have to say as you cannot contact them any other way.

[ravenstar68]

If anyone's interested here are my port forwarding rules on the Hub 3

Note: The hub 3 is unusual in that while most other devices specify the external port first, it instead asks for the internal IP and port first.

[ignade82]

Ok I set up port forwarding but on 192.168.0.253

What should I do with port triggering ?it is empty.

I got DMZ  on 192.168.0.19 for my xbox.

I have amazon fire tv ,3 android , 2 laptop 

[ravenstar68]

Leave Port triggering alone.

The Port forwarding is to stop SSDP and mDNS queries getting to the device in the DMZ from the internet.

[joeron]

hello ravenstar, im still on superhub 1, so i dont have the seting like in ur screenshot with local port range 65535-65535 so is it just the case of port forwarding like below? does it still work out fixing the problem, thanks

name   portrange  Protocal   ip address
SSDP  1900          UDP        192.168.0.253
mDNS  5353         UDP         192.168.0.253

[ravenstar68]

That will work as long as there's no device currently using that IP address.  As the hub will try to send packets there and won't be able to so it'll drop them.

[joeron]

thank you for the fast reply and for puting me at ease

[mattcd]

As have others, I've received the mDNS letter.  A Shodan IOT search confirms mDNS port open on my public IP.

However, a nmap scan on my network doesn't show any devices listening on the port and I don't have any port forwarding rules at all in the SuperHub3.

The only thing I can think of is that I've only recently removed my raspberry pi from the DMZ, so maybe that showed up...

I'm thinking as nmap shows no mDNS ports listening and there aren't any firewall rules I can modify that there's not a lot I can/need to do..!?!  Frustrating that you can't apply deny rules to the inbound rules on the firewall.

[Dominatez]

Sorry to drag this up.


Don't Virgin (Yes they do - Just checked) Block the netbios ports from 135 - 139 !!!

And i am curious as to why i received a letter saying i had been compromised on my own network (DId make me laugh) !!
I am running a ps3 media server program which shares all my media and no one can access this unless they are on my subnet.
I know my way around a cisco network / switches and company routing.

Just looked at Shadowscan. WTG geniuses. Pop out the information that there is between 4 and 8 million DNS Amp attack boxes that are still alive. You only need a handful to completely cripple a website.
And to make it worse, they told you what countries have the highest and what port. I always wondered where some idiots got their IP ranges from for Amp Scanning.

Anyway, if it helps, i binned the letter and ignored it, as for me, it was a mere informational.

EDIT - For anyone who has a linux box, just enter then following to see if your box has NTP enabled and running.

root@sd-104134:~# ntpdc -n -c monlist 192.0.2.1

[ravenstar68]

Actually the Netbios Trio of Ports is 135 139 and 445 - and if you check you'll find Virgin lifted the block a couple of years ago.

Ravenstar68