{
  "port": 1900,
  "protocol": "udp",
  "service": "SSDP (UPnP discovery)",
  "oneLiner": "UPnP device discovery — a router, TV, printer, or media box announcing itself on the LAN.",
  "whatItIs": "SSDP is the discovery half of UPnP: devices multicast NOTIFY announcements to 239.255.255.250:1900 and answer M-SEARCH queries with a URL to their XML device description. It shows up on scans because consumer routers, smart TVs, game consoles, printers, and NAS boxes all run a UPnP stack by default. On a router it usually fronts the IGD service that lets any LAN host open inbound port forwards without authentication.",
  "exposure": {
    "verdict": "never",
    "note": "SSDP is a well-known UDP reflection/amplification vector (CISA measured a 30.8x bandwidth amplification factor) and internet-facing UPnP IGD lets strangers punch holes through your NAT."
  },
  "checkCommand": "printf 'M-SEARCH * HTTP/1.1\\r\\nHOST: 239.255.255.250:1900\\r\\nMAN: \"ssdp:discover\"\\r\\nMX: 1\\r\\nST: ssdp:all\\r\\n\\r\\n' | nc -u -w 2 239.255.255.250 1900",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 1900",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1900",
      "kind": "iana"
    },
    {
      "title": "Open Connectivity Foundation — UPnP Device Architecture specifications",
      "url": "https://openconnectivity.org/developer/specifications/upnp-resources/upnp/",
      "kind": "official-docs"
    },
    {
      "title": "CISA AA14-017A — UDP-Based Amplification Attacks (SSDP: 30.8x)",
      "url": "https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks",
      "kind": "official-docs"
    },
    {
      "title": "miniupnp — MiniUPnPd / MiniSSDPd reference implementation",
      "url": "https://github.com/miniupnp/miniupnp",
      "kind": "github"
    }
  ]
}