TCP Port 5678 traffic to 192.168.X.1 hosts

[Glenn Hanratty]

Has anyone seen entire subnets of WINXP/WIN98 hosts sending 62-byte frames to 192.168.2.1, 5.1, and 7.1 for no reason? I have four subnets in one bldg that are constantly sending to these private addresses that don't exist on my network.

So far, we have seen that it's SVCHOST.EXE that's using TCP 5678 and just spewing. If you kill the process it just respawns and sends.

[owillins]

I think this is because of a possible virus attack on your network. Try blocking the port TCP 5678 using some access list. Apply this access list on the router's ethernet port and check if you are getting any hits on the access list. If you see a large number of hits it is because of a virus. This may even cause the CPU utilization on the router to go high. Check for the source of this addresses, by enabling "ip route cache" on the router and using "sh ip cache flow" command