LS-CH1.0TL-V2 causing UDP Port Scans in Router

[Welly]

I have a Linkstation Live LS-CH1.0TL running f/w 1.24 connected to my gigabit network via a TP-LINK TL-SG1008D 8 port gigabit switch. This in turn is attached to a Zyxel P-660HW-T1 v2 broadband router. The router is reporting bursts of "ports scan UDP" from the Linkstation as "ATTACKS" - they seem to come in bunches of roughly 30 taking 7 or 8 minutes every half hour or so. Port 22936 is the main one reported, with occasional Ports in the ranges 5xxxx or 6xxxx occurring.

Must be slowing down my router ... any ideas please?

Welly.

[Dustrega]

Possible UPnP requests for Web Access?

[Welly]

Webaccess is not in use - only Media Server has been started.

[Dustrega]

It's some kind of UPnP connection (hence the 22936 port coming up).  What were the 5xxx and 6xxx ports exactly?  I'm not going to put the possibility that the media server is somehow updating the files out there as I've never heard of it happening before.  However, most firewalls only report incoming attacks rather than outgoing traffic as attacks.

[Welly]

In the last log reported from the router the other ports were 63848, 50154, 61641, 62664 & 62648.

[Dustrega]

Those still appear to be UPnP requests.  Attacks (or mistaken connections) that might be directed towards accessing your network via UPnP.  I don't know what else to make of it aside from that.