Multiple Tunnel Adapters in Vista

Hi,

I'm running Vista Ultimate and noticed recently that I have many "Tunnel
adapter Local Area Connection* nn" (nn=different numbers for different
connections). Most show the Media State as "Media diconnected", but a couple
are different, e.g.

Teredo Tunneling Pseudo-Interface
Microsoft ISATAP Adapter #5

with different IPv6 addresses.

Can anybody shed some light on this and is there any intrusion risk
associated with them?

Thanks

Microsoft ISATAP, Teredo Tunneling Pseudo-Interface are used for IPv6
and needed by the operating system, the other adapters are used
internally by Vista`s kernel for network support.

They do not pose a secuity risk if your machine is running the latest
windows updates, I myself have 10 device adapters (istap, RAS async,
teredo tunnel and 5 different WAN miniport devices) If they show up in
your network & sharing center then it would be a concern.


--
dmex

Thank you very much, dmex. None of these connections show up in my Network &
Sharing Center, and I tend to keep my computers up-to-date, especially wrt
critical and important Windows updates and AV/Firewall updates.

WJB

"dmex" wrote:

>
> Microsoft ISATAP, Teredo Tunneling Pseudo-Interface are used for IPv6
> and needed by the operating system, the other adapters are used
> internally by Vista`s kernel for network support.
>
> They do not pose a secuity risk if your machine is running the latest
> windows updates, I myself have 10 device adapters (istap, RAS async,
> teredo tunnel and 5 different WAN miniport devices) If they show up in
> your network & sharing center then it would be a concern.
>
>
> --
> dmex
>

[rad131304]

Quote:

Originally Posted by WJB

Thank you very much, dmex. None of these connections show up in my Network &
Sharing Center, and I tend to keep my computers up-to-date, especially wrt
critical and important Windows updates and AV/Firewall updates.

WJB

"dmex" wrote:

>
> Microsoft ISATAP, Teredo Tunneling Pseudo-Interface are used for IPv6
> and needed by the operating system, the other adapters are used
> internally by Vista`s kernel for network support.
>
> They do not pose a secuity risk if your machine is running the latest
> windows updates, I myself have 10 device adapters (istap, RAS async,
> teredo tunnel and 5 different WAN miniport devices) If they show up in
> your network & sharing center then it would be a concern.
>
>
> --
> dmex
>

If you really want to blow away the isatap connections, it's pretty simple.

Option 1:
-Click Circle Windows Icon (AKA Start Menu for XP)
-Right Click on Computer
-Click Manage (trips UAC)
-Click on Device Manager
-Click View > Show Hidden Devices
-Click Network Adapters
-Delete Network Adapters to your heart's content, just try and avoid the important ones like ones associated with your NIC and WLAN card
(I cannot take credit for this; I got it off of AAron's blog - I dont remember the url off the top of my head though )

Option 2:
-Download Devcon.exe from KB311272 (this is the command line device manager)
-run self-extractor to something like c:\temp\devcon
-Copy contents of your OS type (i386 or ia64) in your System32 directory (this requires Administrator Privlages in Vista)
-Run CMD as Administrator (Run As ... may be required in XP depending on your user rights, but probably not unless you're not at least a local admin)
-type devcon.exe remove *ISATAP*

-Note that while the second option is "automated", you only delete Root\*ISATAP\#### network drivers, so if you want to can the Teredo tunneling adapter you'll have to use:

devcon.exe find root*

to locate that specific adapter, as I don't recall what it is off the top of my head but I know it's not listed as a ROOT\*ISATAP.

Because of that stupid wildcard in ROOT\*ISATAP\#### naming, I haven't figured out how to kill individual isatap.{ID} Tunnels, but frankly I didn't really care at the time to figure that out, since I wanted to get them all.

Hope this helps!