Threat Prevention Messages

[rfasano]

What does this mean and how should I react:

drop udp [$EXTERNAL_NET,![52.23.111.175]] 3478 -> 192.168.1.211 any (msg:"ET INFO Session Traversal Utilities for NAT (STUN Binding Response)"; content:"|01 01|"; depth:2; content:"|21 12 a4 42|"; distance:2; within:4; reference:url,tools.ietf.org/html/rfc5389; classtype:attempted-user; sid:4000067; rev:1; metadata:created_at 2013_01_04, updated_at 2013_01_04

Seems to be coming from Amazon to my computer.

 

[fredbert]

That's the ET Open signature that defines the rule that was triggered. It's a message telling you about a STUN connection. There can be reasons to use STUN: some IP voice services use it.

STUN - Wikipedia

en.wikipedia.org