# WHATPORT(1900)

## NAME

port 1900 — SSDP (UPnP discovery) — UPnP device discovery — a router, TV, printer, or media box announcing itself on the LAN.

Protocol: UDP  
IANA registry

## DESCRIPTION

SSDP is the discovery half of UPnP: devices multicast NOTIFY announcements to 239.255.255.250:1900 and answer M-SEARCH queries with a URL to their XML device description. It shows up on scans because consumer routers, smart TVs, game consoles, printers, and NAS boxes all run a UPnP stack by default. On a router it usually fronts the IGD service that lets any LAN host open inbound port forwards without authentication.

## EXPOSURE

**Do not expose.** SSDP is a well-known UDP reflection/amplification vector (CISA measured a 30.8x bandwidth amplification factor) and internet-facing UPnP IGD lets strangers punch holes through your NAT.

## CHECK

```sh
printf 'M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: "ssdp:discover"\r\nMX: 1\r\nST: ssdp:all\r\n\r\n' | nc -u -w 2 239.255.255.250 1900
```

## SEE ALSO

- iana — [IANA Service Name and Transport Protocol Port Number Registry — 1900](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1900) (iana.org)
- docs — [Open Connectivity Foundation — UPnP Device Architecture specifications](https://openconnectivity.org/developer/specifications/upnp-resources/upnp/) (openconnectivity.org)
- docs — [CISA AA14-017A — UDP-Based Amplification Attacks (SSDP: 30.8x)](https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks) (cisa.gov)
- source — [miniupnp — MiniUPnPd / MiniSSDPd reference implementation](https://github.com/miniupnp/miniupnp) (github.com)

---

HTML: <https://whatport.net/1900/> · JSON: <https://whatport.net/1900.json> · full dataset: <https://whatport.net/ports.json>