SSDP Discovery and Router Blocked comms

[arialtypes 0]

Hello everyone once again. 

 

So, yesterday i started to have some connections problems again.. I connected to my wifi and after 20s less or more, my wifi disconnected and that happened 4 times yesterday and a few times last months. 

After that i decided to set my home network as public in eset configuration, after that i get 2 comms blocked every 5min.

 

SSDP Discovery - Blocked (UPnP requests, svchost.exe) 

My router - Blocked (UPnP requests, svchost.exe as well) 

 

Today, the wifi drop thing happened and to be honest i thought that was something related to energy management but after taking a quick look at that it doesnt seems to be that. 

 

I checked DNS leaks by doing a online test and i only saw my ISP servers.

Proxies were not detected as well by those online tests.

IP reputation looks good.

 

How can i tell that this is something malicous or just something normal being blocked by eset since i dont marked my internet as safe? 

[arialtypes 0]

I stopped the SSDP Discovery service and the blocked comms stopped showing at troubleshooting.  

My intetion with this post is to understand if this is a normal thing or if it is something related to malicous attacks. 

Thank you for your time. 

if it helps: 

- my internet use if 80% educational and 20% (Twitch, Netflix..) 

- i dont use VPNs

- my software is always updated with the most recent updates (windows and eset)

- my internet driver seems to be updated 

- besides my laptop i just have the TV box and Router connected. 

 

[itman 1,659]

4 hours ago, arialtypes said:

After that i decided to set my home network as public in eset configuration, after that i get 2 comms blocked every 5min.

SSDP Discovery - Blocked (UPnP requests, svchost.exe) 

My router - Blocked (UPnP requests, svchost.exe as well) 

This is normal behavior when using Eset Public profile for the active network adapter connection. Public profile by default will block all inbound network traffic for which a specific inbound firewall rule does not exist. That is on the Public profile, no local subnet IP addresses are trusted. Hence, any Eset default firewall rules that allow inbound network from the Trusted zone are N/A. When the Eset Home or office profile is used, all local subnet network IP addresses are trusted by default and are automatically added to the Trusted zone for the active network adapter connection.

[arialtypes 0]

15 minutes ago, itman said:

This is normal behavior when using Eset Public profile for the active network adapter connection. Public profile by default will block all inbound network traffic for which a specific inbound firewall rule does not exist. That is on the Public profile, no local subnet IP addresses are trusted. Hence, any Eset default firewall rules that allow inbound network from the Trusted zone are N/A. When the Eset Home or office profile is used, all local subnet network IP addresses are trusted by default and are automatically added to the Trusted zone for the active network adapter connection.

Thank you. I was worried because i saw in eset tools (network conections) that svchost was sending 4MB and after i disabled SSDP discovery service and UPnP at router it stop sending so much data. 

 

Also, my pc got faster. Is this normal? 

 

Thank you @itman

 

[itman 1,659]

5 hours ago, arialtypes said:

Also, my pc got faster. Is this normal? 

No. I see no performance difference with SSDP enabled or disabled.