UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) and....

[#1]

I have Windows7 Home Premium, Thomson 585v7 router. I am sole user and administrator, My computer is connected by Ethernet without network. I use Routerstats.
Lately I have noticed that the routers log has extremly frequent examples of
UPnP action 'AddPortMapping' from ip=192.168.1.64 (Success) .
These are accompanied by LOGIN User tried to login on [HTTP] (from 192.168.1.64)
My screen is full within the hour with the entries.
Can anyone tell me if this is usual and what the entries are for? Can the frequency of the entriesbe reduced or stopped? What risks would that raise?

[#2]

What is your systems IP address?
Do you have the wireless enabled on the router - if so, turn it off if you don't use it.

[#3]

Hi there
Connection settings states " server assigned", currently.
This rocking horse is not sure how to switch off wireless on the 585.

[#4]

You'll probably find that 192.168.1.64 is the IP your router has assigned your computer - In that case, the `UPnP action 'AddPortMapping'` is nothing to worry about (probably), as it's just your computer telling the router it wants to be able to receive a certain port
Could be you've installed BitTorrent software that's used it to make your speeds faster, or something like Skype
Or, it could also be a trojan making life easier for whoever created it 
If you've been using new software recently that uses the internet to communicate (like Skype / BitTorrent), you probably have nothing to worry about... Thuogh you might want to run a virus check, too, just in case

[#5]

Point is though that it leaves no room for any important info that may be needed, soon lost.
No Skype or BitTorrent.
Will run virus check later today.

[#6]

Have a read about uPNP and you should find it's nothing to worry about.

[#7]

Ben I haven't had chance to read the article fully but uPNP ilooks as you say from quick scan innocuous.
However, it's the amount of entries, that mean potentially more important events are discarded,that are the point of my OP

[#8]

Quote from: lucerne

uPNP ilooks as you say from quick scan innocuous.

If you aren't using uPNP just disable it in your router.

[#9]

Hi Jaggies.
So easy: a lot of sites were saying it had to be disabled in Win7!!!

[#10]

In my OP I mentioned the "LOGIN User tried to login on [HTTP]... [192.168.1.64]" entries that accompanied the UPnP action ones. The LOGIN events are still coming in spades, and also are not marked 'success'. I fail to see why there should be so many. Why are they happening still?  Are they able to be turned off too? I do not recall seeing the entries, or there were  far fewer, with my Netgear.
Coincidentally the connection dropped around 2.40 pm and reconnected at 1000kbps lower,
Coincidental?

[#11]

If there is any issue with logon attempts from the local network then it's a virus / spyware / malware issue.

[#12]

Regarding the profusion of: LOGIN User tried to login on [HTTPS] (from 192.168.1.64)
I have noticed this (with the TG585). I think it is the web-browser, and normal.
Every time you view a page of the router's web-interface your browser sends authentication to the router. You do not really login once at the start, but every time you view a page (the browser caches the username and password and resends them each time) -- that is how HTTP 'basic access authentication' works.
You can check this by opening your browser, viewing a few of the router pages, then closing the browser, then accessing the router with telnet and viewing the log (systemlog show): there should be a few of the 'LOGIN' messages just between the times you used the browser.
I do not know why the router bothers to show this when it is so useless in the usual case. But, strictly, it makes some sense.
Well, that is my conjecture on the matter based on observed evidence and available knowledge -- and it should be confirmable/refutable on those.

[#13]

Is RouterStats using the admin account to access the router? Simultaneously logging in from your browser might confuse things.
I suggest setting up a second user for RouterStats to use. I think it needs admin privileges (or one step down) for access to the statistics pages. See if that reduces the number of login warning messages.