Do I block access from svchost to DHCP?

Do I block access from svchost to DHCP?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Computer Software Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Do I block access from svchost to DHCP? Mister C 06-14-2005
Posted by Mister C on June 14, 2005, 6:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
From time to time I get this message from my Sygate firewall.
Should I let this program through?

"Generic Host Process for Win32 Services (svchost.exe)
is trying to connect to [62.255.64.20] using remote
port 67 (BOOTPS - Dynamic Host Configuration Protocol
[DHCP] Server). Do you want to allow this program to
access the network?"

This is my setup:

1. I use WinXP + SP1 at home.
2. My broadband ISP is NTL Cable
3. I connect direct to my ISP am am not part of a network.
4. I have disabled XP's firewall and use only Sygate firewall.

To my untutored eye it seems like a good thing to allow this and let
svchost on PC communicate with what I think is my ISP's DHCP server.

However this web page says I should completely block svchost.exe in
Sygate. http://www.howtodothings.com/ViewArticle.aspx?Article=51

Who is right?


Posted by Michael J. Pelletier on June 14, 2005, 11:46 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Mister C wrote:

> From time to time I get this message from my Sygate firewall.
> Should I let this program through?
>
> "Generic Host Process for Win32 Services (svchost.exe)
> is trying to connect to [62.255.64.20] using remote
> port 67 (BOOTPS - Dynamic Host Configuration Protocol
> [DHCP] Server). Do you want to allow this program to
> access the network?"
>
> This is my setup:
>
> 1. I use WinXP + SP1 at home.
> 2. My broadband ISP is NTL Cable
> 3. I connect direct to my ISP am am not part of a network.
> 4. I have disabled XP's firewall and use only Sygate firewall.
>
> To my untutored eye it seems like a good thing to allow this and let
> svchost on PC communicate with what I think is my ISP's DHCP server.
>
> However this web page says I should completely block svchost.exe in
> Sygate. http://www.howtodothings.com/ViewArticle.aspx?Article=51
>
> Who is right?

It sounds like this is you dhcp client. I would not advise blocking that!

Michael


Posted by Bit Twister on June 14, 2005, 1:47 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Tue, 14 Jun 2005 18:32:46 GMT, Mister C wrote:
> From time to time I get this message from my Sygate firewall.
> Should I let this program through?
>
> "Generic Host Process for Win32 Services (svchost.exe)
> is trying to connect to [62.255.64.20] using remote
> port 67 (BOOTPS - Dynamic Host Configuration Protocol
> [DHCP] Server). Do you want to allow this program to
> access the network?"
>
> This is my setup:
>
> 1. I use WinXP + SP1 at home.

Hmmm, missing lots of updates there. Poor security practice.

> 2. My broadband ISP is NTL Cable

Well that explains it.
nslookup 62.255.64.20
shows name = dhcp1-popl.server.ntli.net.

> 3. I connect direct to my ISP am am not part of a network.

You are part of NTL cable network and your node gets it's ip address
from NTLI's DHCP server. Your DHCP client and their DHCP server chat with each
other through ports 67,68 to get/renew your DHCP assigned ip address.



Posted by Walter Roberson on June 14, 2005, 8:03 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
:On Tue, 14 Jun 2005 18:32:46 GMT, Mister C wrote:
:> This is my setup:

:> 1. I use WinXP + SP1 at home.

:Hmmm, missing lots of updates there. Poor security practice.

As best I (not a Windows expert!) can tell, Microsoft is making
security patches available for both SP1 and SP2 at present.
Is there a significant security difference between fully-patched SP1
and fully-patched SP2?

I was running SP2 but there was something that wasn't working that
did work under SP1 that I installed on a different partition. If
one cannot effectively run one's system with SP2 but can with SP1,
then is it truly "good security practice" to upgrade to the version
that is functionally unusable under the local circumstances?

If so, then would it not be even better security practice to upgrade
to Windows HP -- a version of Windows that consists of nothing other
than repeated processor HALT instructions, to keep the system from
running anything at all ?
--
Oh, to be a Blobel!


Posted by Bit Twister on June 14, 2005, 3:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On 14 Jun 2005 20:03:56 GMT, Walter Roberson wrote:
>:On Tue, 14 Jun 2005 18:32:46 GMT, Mister C wrote:
>:> This is my setup:
>
>:> 1. I use WinXP + SP1 at home.
>
>:Hmmm, missing lots of updates there. Poor security practice.
>
> As best I (not a Windows expert!) can tell, Microsoft is making
> security patches available for both SP1 and SP2 at present.

(not a Windows expert either) but I would bet they are not.

> Is there a significant security difference between fully-patched SP1
> and fully-patched SP2?

Then why make a SP2.

> I was running SP2 but there was something that wasn't working that
> did work under SP1 that I installed on a different partition.

See there is a difference between SP1 and SP2. I would guess sp2 closed
a security flaw on a system call used by the defunct application.
Could have been an update to make a system call argument mandatory
which is not provided in the failing application causing it to fail.

> If one cannot effectively run one's system with SP2 but can with
> SP1, then is it truly "good security practice" to upgrade to the
> version that is functionally unusable under the local circumstances?

You might want to read the above sentence out loud.

Having an unpatched system is negligent.

Let's say someone uses your unpatched system to steal credit cards and
sells them using your system. Do you think, "but, but, judge, I
installed a patch and I could not run one of my applications so I
backed out the patch." is going to keep you out of jail.

> If so, then would it not be even better security practice to upgrade
> to Windows HP -- a version of Windows that consists of nothing other
> than repeated processor HALT instructions, to keep the system from
> running anything at all ?

Now you are just being stupid. :(
http://www.eeye.com/html/research/upcoming/

My solution was to install Mandrive/Mandrake linux. :)


Similar ThreadsPosted
Looking to block web access August 23, 2005, 1:24 am
RE: Hacker on Internal Net: DHCP May 11, 2008, 10:06 pm
When I log on I get a message that says windows ce networking: Your ip address lease has expired by dhcp July 13, 2007, 7:44 am
Way to block PC on LAN August 16, 2007, 6:22 am
block Ares September 19, 2006, 1:10 am
Help!! Constant connection to Microsoft I cannot block. June 13, 2005, 7:05 pm
Access is Denied August 24, 2006, 9:04 pm
small business and net access? August 26, 2005, 11:31 am
Identity and Access Management (IAM) December 8, 2005, 9:55 am
Not able to access Internet explorer July 4, 2007, 8:43 am

The site map in XML format XML site map

Contact Us | Privacy Policy