Port reference
Port 3702 (UDP) – WS-Discovery
WS-Discovery — a multicast protocol that locates web-service devices like printers and IP cameras on a local network.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on many printers, IP cameras, NAS, and Windows hosts. Frequently exposed to the internet, where it is abused for DDoS amplification.
What is port 3702 used for?
Port 3702 carries WS-Discovery (WSD), a multicast protocol that lets devices find each other automatically on a local network. Printers, IP cameras, NAS boxes, and Windows machines use it to advertise themselves so you can add them without typing an IP address — for example Windows network device discovery and the WSD printer ports in Windows. It is meant to stay on your local network, not the internet.
When would you open it?
You normally would not open port 3702 on a firewall or forward it. WS-Discovery is designed to work within a single local network segment; opening it across the internet serves no legitimate purpose and only invites abuse. Keep it on the LAN.
Is it safe to open?
Exposing UDP 3702 to the internet is unsafe — it is heavily abused for amplification DDoS and leaks a device inventory. Block it at the internet edge and disable WSD on devices that don't need it. See the security notes below.
How to check if this port is open
ss -tulpn | grep :3702
nmap -sU -p 3702 <target>netstat -ano | findstr :3702
Test-NetConnection <host> -Port 3702 # TCP onlylsof -i :3702
nmap -sU -p 3702 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 3702 to your device's local IP, internal port 3702, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 3702/udpsudo firewall-cmd --permanent --add-port=3702/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 3702 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 3702" -Direction Inbound -Protocol UDP -LocalPort 3702 -Action AllowSecurity & risks
Common attacks
- UDP amplification / reflection DDoS off exposed WSD devices
- Enumeration of IP cameras, printers, and NAS via probe responses
- Information disclosure of device type, model, and services
- Pivoting from discovered devices into the internal network
Hardening
- Block UDP 3702 at the internet edge — it should never be public
- Disable WS-Discovery / WSD on devices that do not need it
- Restrict multicast discovery to trusted local segments
- Patch printer, camera, and NAS firmware promptly
- Monitor for spoofed-source probes indicating reflection abuse
How to block this port
sudo ufw deny 3702/udpsudo firewall-cmd --permanent --remove-port=3702/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 3702 -j DROPNew-NetFirewallRule -DisplayName "Block 3702" -Direction Inbound -Protocol UDP -LocalPort 3702 -Action Blocknmap snippet
nmap -sU -p3702 --script broadcast-wsdd-discover <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 3702 used for?
- Port 3702 is WS-Discovery (WSD), a multicast protocol that lets devices such as printers, IP cameras, and NAS advertise themselves and be found automatically on a local network.
- Why is WS-Discovery a DDoS risk?
- A small spoofed probe makes an exposed WSD device send a much larger reply to the victim. With many internet-facing devices, attackers turn this gap into a high-volume amplification DDoS.