2

I had look at the firewall logs and i can see my production server connects to microsoft (13.92.90.48) on UDP port 3544. A quick reading suggests this is to do with Teredo tunneling (IPV6 translation tech). Unless I am mistaken this done by Windows server; if so does this OS Service can post data to this port creating a risk of exposing sensitive data on the server?

Should I be dropping these UDP packets at firewall as risk avoidance measure?

Does anyone know whether an outbound call to 13.92.90.48 on port 3544 is a well known action by windows servers (2012 R2 ver for instance)?

  • As you've already assessed the possible traffic going over the network on this one port you could sample the packets such as with Wireshark. You'll have to weigh the risk with potentially causing a outage on a production server. Ideally replicate the traffic on a test server with fake data and block it there. Just be ready to rollback your firewall change and notify your colleagues who might need to do the rollback. – lloyd Dec 21 '16 at 5:05
  • So you are stating there is definite risk in allowing this call. I am more inclined to know whether the teredo call is a legitimate call and should be ignored from the statistical anomaly detection – Lin Dec 21 '16 at 20:25
  • 1
    Not enough information to determine the risk level. There is a definite risk in blocking a port based on a anomaly. – lloyd Dec 22 '16 at 3:07
  • added one more query summarise the real question in mind – Lin Dec 23 '16 at 0:18
2

Recommendation at: https://www.stigviewer.com/stig/windows_7/2013-10-01/finding/V-17449 Is to block outbound IPv6 UDP 3544 for Windows Servers Reason: IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility. Blocking UDP 3544 with the firewall aids in preventing this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.