UDP port 6771 (Incoming) ???

Hello there. I'm trying to figure something out. Every time I restart my PC and run Utorrent, I get a Norton Internet Security box appear.

It takes the following format:

Program Alert

A remote system is attempting to access uTorrent on your computer

Program Utorrent.exe

Path C:\Program Files\uTorrent

Remote Address 192.168. * . * : 6771

Local Address 239.192.152.143 : 6771

Protocol UDP (Inbound)

What do you want to do?

Allow Always (Recommended)

This message appears everytime I start uTorrent. I've already set outgoing and incoming rules for the program in utorrent. I allow all TCP and UDP traffic out on all ports, and I only allow TCP and UDP inbound on utorrents specific incoming port, which is 37503 in my case.

So why do I keep getting this message? What is it for? Is it safe to allow it? I know of Trojans using that port number and something called Deep Throat in particular. I'd appreciate any and all advice. Thanks.

Got DHT on? It's either that or LPD. But I'm leaning towards DHT. Is it contacting router.utorrent.com?

Both DHT Network and DHT for new torrents are enabled. Local peer discovery is also enabled.

That's for local peer discovery.

A quick google search for "239.192" reveals Multicast as the address space.

Should I allow it then?

Yes. It won't go past your router anyway.

Can I ask how exactly does LPD work then? It's obviously already come through my routers firewall, hence the message box from Norton. So, If I allow it, I'm supposing that it will make it's way out of my router again, yes? I mean, if it didn't, then what would be the point?

LPD - Local Peer Discovery.

It uses a UDP multicast search to identify other peers in your subnet that are also on torrents you are on.

Your router does not forward multicast searches, so no it won't make it out of your router.

7 months later another user of uT (me lol) discovers a strange UDP connection with port 6771, unknown address with a significative data transfert 28 ko in 2 hours

is it the NSA ?

Did you even read the thread?

yes I read it but I understand that no answer has been found to the problem is it right ? why this port connected in UDP ?

You understand incorrectly.

Users are being overparanoid about local peer discovery.

Excuse me but I'm french and these posts are sometimes difficult for me

The conclusion is that it is not interesting to worry about supposed attackers spys or what..

it is quite sure we will not have more information about their identity

but in this case I prefer to block all UDP attempts

The conclusion is that you should pay attention to the thread.

LOCAL PEER DISCOVERY.

As in NOT hackers.

Not spies.

Not attackers.

Ok thanks I did not correctly understand your 2008-03-25 09:00:00 post

I believed that this explaination was excluded and it is the contrary

I'm sorry

"so no it won't make it out of your router" sense stay mysterious for me what does it mean ? that LPD does not work with his routeur ?

It means that it won't go onto the internet, but stays local.

Which is why it's called local peer discovery

oh yes but what is his utility in "local" ?

What does that even mean?

"local" here means "only on your LAN" if that's what you're asking

LDP looks for peers in your LAN.

LDP uses multicast.

Your router forwards the multicast traffic to all PCs in the LAN but does NOT send it towards the internet (WAN).

More info in French: http://fr.wikipedia.org/wiki/Multicast

lol I read wiki I understood nothing lol

in fact me I have no routeur but an USB modem

then I do not see the interest of UDP in uTorrent for the moment and it sends me to my specific thread about this

Then turn of LPD in the µtorrent options.

But DHT also uses UDP and does go over the internet. There is a need for UDP in µTorrent.

DNS requests for one.

If you don't wanna see UDP broadcasts for local peer discovery, then turn it off. It's an option for a reason.