Svchost trying to take UDP on port 500?

[Rummy]

This pops up occasionally, and I can't seem to find clear information on whether it's a good thing, a bad thing, or just a thing thing that doesn't matter.

 

I run Commodo and it occasionally asks if I want to allow a connection, I ususally deny because I know svchost.exe is a windows related file, and I've no idea what it's trying to do on 500 so I err on the side of caution assuming if it's really necessary it'll keep bugging me.

 

It doesn't, but I am curious what's been causing this? Googling turns up talk of IPSec and VPNs or something, and also alludes to lsass.exe possibly listening on the same port, but I can't really determine the nature of what/why this is happening. Does anyone know what would trigger this type of a connection? Is someone out there trying to attack me? Moreso, is my computer doing something behind the scenes that I don't know about??

[Emasher]

Next time it a happens, open up task manager and make sure all instances of svchost.exe that are running are in the correct system folder.

[Ten10]

Hi Rummy, as the resident N-E Comodo evangelist I would consider it my duty to shed some light on the situation. Here you go: http://forums.comodo.com/general-security-questions-and-comments/svchostexe-t11207.0.html

[Rummy]

Ahh! Comodo official forums! Why didn't I think of that! After scouting round a bit on there, it seems it might be related to the fact I had uTorrent open, and is caused by a combination of that and Windows 7(apparently), it's to do with IPv6 tunelling. Basically a peer trying to get at my stuff through IPv6 rather than IPv4.

 

I think. IP routing/porting beyond my own router is lost on me, and I've no idea of difference in IPv4/6 lol. Thanks for the replies though guys. For anyone interested this thread helped solve the mystery;

https://forums.comodo.com/firewall-help-cis/unblocking-ip-used-by-utorrent-t74685.0.html