Port reference
Port 1900 (UDP) – SSDP/UPnP
Simple Service Discovery Protocol — the discovery layer of UPnP that lets devices find each other on a LAN.
Default state
Open by default on many home routers, smart TVs, printers, and IoT devices. Frequently and dangerously exposed to the internet.
Common attacks
- SSDP reflection / amplification DDoS
- Exposed UPnP control abuse (port mapping, NAT manipulation)
- Device and network reconnaissance
Hardening
- Block UDP 1900 inbound at the internet edge
- Disable UPnP/SSDP on the WAN interface of routers
- Turn off UPnP entirely where it isn't needed
- Patch IoT/router firmware and segment IoT devices
nmap snippet
nmap -sU -p1900 --script upnp-info <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 1900?
UDP 1900 carries SSDP (Simple Service Discovery Protocol), the discovery
component of UPnP (Universal Plug and Play). Devices multicast M-SEARCH queries
and NOTIFY announcements so that routers, smart TVs, printers, media servers, and
IoT gadgets can find each other and auto-configure on a LAN. It is enabled by default
on a huge range of consumer hardware.
Why it matters for security
SSDP is meant for the local network only, but countless routers and IoT devices leak it to the internet. Because a small query returns a much larger response, open SSDP responders are a prime reflection and amplification DDoS source and have fueled some of the largest recorded attacks. Where UPnP control endpoints are also exposed, attackers can manipulate port mappings and NAT rules to punch holes through the firewall, and the responses reveal device models and firmware for targeting.
How it's attacked
Attackers scan UDP 1900 for responsive devices, then send spoofed M-SEARCH queries
to reflect amplified traffic at a victim for DDoS. Exposed UPnP control URLs
are abused to add malicious port forwards, exposing internal services or routing
attacker traffic. Discovery replies also feed reconnaissance of device types and
versions.
Hardening checklist
Block inbound UDP 1900 at the perimeter and ensure routers do not run SSDP/UPnP on their WAN interface. Disable UPnP entirely where it isn't required, segment IoT devices onto their own network, and keep router and device firmware patched. Use the nmap snippet above to check for UPnP/SSDP exposure on devices you are authorized to test.
Related ports
Frequently asked questions
- What is port 1900 used for?
- UDP 1900 carries SSDP, the discovery protocol behind UPnP. Devices use it to announce and find services on a local network — it should never be reachable from the internet.
- Why is SSDP a DDoS risk?
- A small SSDP M-SEARCH query yields a much larger reply, so internet-exposed devices are abused as reflectors/amplifiers to generate high-volume DDoS against third parties.