A Windows box with UPnP on — the HTTP endpoint that receives SSDP event notifications.
Microsoft's port reference lists TCP 2869 twice: UPnP Device Host, and SSDP event notification for the SSDP Discovery service (which used TCP 5000 before Windows XP SP2). It is an HTTP listener registered in the kernel HTTP stack — an unmatched request typically answers with a Microsoft-HTTPAPI/2.0 header — carrying UPnP eventing and device descriptions on the local network. It pairs with UDP 1900, which does the discovery multicast. IANA's registered name for 2869 is icslap, from Internet Connection Sharing.
Do not expose
UPnP is a link-local trust model with no authentication; on a public interface it advertises the host and exposes the UPnP stack, which has a history of remotely reachable bugs. Stop SSDP Discovery if you do not need it.
$ curl -si --max-time 5 http://TARGET:2869/ | head -5Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.