NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

baronfunke's avatar
baronfunke
Aspirant
Jul 27, 2016

Traffic to ReadyNAS being blocked

Hello - I am running Symantec Endpoint Protection on my workstation, and it is periodically (regularly) blocking traffic from my ReadyNAS 312.  The error message I get is:

Somebody is scanning your computer.
Your computer's UDP ports:
63778, 64897, 50252, 58446 and 56153 have been scanned from *IP of ReadyNAS*

 

It looks like it only affects the computers I have the "workstation" version of SEP installed, which includes the Proactive Threat Protection and Network Threat Protection modules installed.  I don't have any apps installed on the ReadyNAS, so I'm not sure what part of its system would be scanning those ports, but I'm mostly curious if that is a known port request or if there's something malicious on my ReadyNAS.  Thanks!

6 Replies

Replies have been turned off for this discussion
  • Hi,

     

    I am Chetan Savade from Symantec Technical Support team. You can send me Network Threat Protection (NTP) traffic logs to review. Send logs at chetan_savade@symantec.com.

    Navigate to SEP client GUI --> NTP --> Options --> View Logs --> Traffic log

     

    If you feel it's a legitimate traffic setup a ReadyNAS in the excluded list. 

     

    • baronfunke's avatar
      baronfunke
      Aspirant

      Thanks, Chetan,

       

      Oddly enough this only happens on one workstation, which is physically connected to the same switch - another workstation further up the network chain with the same anti-virus client has no problems.  I would gladly add an exception to my SEP client, but it doesn't allow me to add folder exceptions unless it can connect to the folder (which it can't once the IP has been blocked [which is done as soon as I connect to the computer]).

       

      Honestly, I think it's a question that could be answered by Netgear - are the ports listed in the original post used by any applications or services on the ReadyNAS, and if so, what are they?

      • StephenB's avatar
        StephenB
        Guru - Experienced User

        baronfunke wrote:

         

        Honestly, I think it's a question that could be answered by Netgear - are the ports listed in the original post used by any applications or services on the ReadyNAS, and if so, what are they?


        I agree that Netgear should be able to provide some info on port use.  All the ports on your list are reserved for private use, so its not clear to me why the NAS would be probing them.  If you have uPNP enabled as a service, perhaps disable that.

         

        But I'd also accept Chetan's offer to help you analyze.  SEP can be quite aggressive on blocking traffic.  My client has blocked SVChost outbound, and also blocked my network printer.  Unfortunately I don't have the authorization needed to customize its rules/policies.  Eventually I found that off network discovery features in the printer solved that particular problem.  

         

         

         

         

NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology! 

Join Us!

ProSupport for Business

Comprehensive support plans for maximum network uptime and business peace of mind.

 

Learn More