{
  "port": 2869,
  "protocol": "tcp",
  "service": "Windows UPnP / SSDP event notification (ICSLAP)",
  "oneLiner": "A Windows box with UPnP on — the HTTP endpoint that receives SSDP event notifications.",
  "whatItIs": "Microsoft's port reference lists TCP 2869 twice: UPnP Device Host, and SSDP event notification for the SSDP Discovery service (which used TCP 5000 before Windows XP SP2). It is an HTTP listener registered in the kernel HTTP stack — an unmatched request typically answers with a Microsoft-HTTPAPI/2.0 header — carrying UPnP eventing and device descriptions on the local network. It pairs with UDP 1900, which does the discovery multicast. IANA's registered name for 2869 is icslap, from Internet Connection Sharing.",
  "exposure": {
    "verdict": "never",
    "note": "UPnP is a link-local trust model with no authentication; on a public interface it advertises the host and exposes the UPnP stack, which has a history of remotely reachable bugs. Stop SSDP Discovery if you do not need it."
  },
  "checkCommand": "curl -si --max-time 5 http://TARGET:2869/ | head -5",
  "links": [
    {
      "title": "Microsoft Learn — Service overview and network port requirements (UPnP Device Host / SSDP event notification, TCP 2869)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 2869 (icslap)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2869",
      "kind": "iana"
    }
  ],
  "ianaName": "icslap"
}