TCP Port 1900 – SSDP / UPnP (Network Service Discovery)
Port 1900 is the standard port for SSDP (Simple Service Discovery Protocol), the broadcast-discovery component of UPnP (Universal Plug and Play). UPnP is the family of protocols that allows networked devices to find each other and configure themselves automatically: a smart TV announcing itself to media players on the same Wi-Fi network, a printer being discovered by a phone, a router accepting port-forwarding requests from a game console without user intervention. SSDP on UDP/1900 is how those devices initially advertise their presence and how clients locate them.
UPnP originated in the late 1990s, championed by Microsoft and a broad coalition of consumer electronics vendors organized as the UPnP Forum (later subsumed into the Open Connectivity Foundation). The discovery protocol uses HTTP-style messages over UDP multicast on the 239.255.255.250 group address, with port 1900 reserved for the traffic. A device joining the network sends NOTIFY messages announcing its services; a client looking for something sends an M-SEARCH request and receives unicast responses from any device that matches.
The protocol is pervasive on home and small-office networks, where it is the default service-discovery mechanism for media servers, printers, network-attached storage devices, smart-home hubs, and consumer routers. On enterprise networks, UPnP is generally disabled or filtered at the network layer, both because the auto-configuration model is inappropriate for managed environments and because of the security history described below.
Inbound UDP/1900 from the public internet to any host is unusual in 2026 and is widely treated as a serious exposure. SSDP was designed for local-network discovery and was never intended to be reachable across the public internet. TCP/1900 is also registered in the IANA registry but is rarely encountered in practice; SSDP is a UDP-only protocol.
About TCP Port 1900
The Internet Assigned Numbers Authority (IANA) registers port 1900 for ssdp. The IANA description reads: ‘SSDP’.
Security Considerations
Port 1900 has two distinct security stories: implementation vulnerabilities in UPnP libraries running on millions of consumer devices, and the protocol’s role as a primary reflector for amplified denial-of-service attacks on the public internet. Our data shows 8 IDS rules referencing this port, all on UDP, which together touch both narratives.
The implementation-vulnerability story is anchored by libupnp, the open-source UPnP library used in firmware by many consumer router and IoT vendors. In January 2013, researchers at Rapid7 disclosed a set of memory-corruption vulnerabilities in libupnp that affected tens of millions of internet-facing devices. The vulnerabilities allowed remote code execution against any vulnerable device whose UPnP service was exposed to the network. Several rules in our dataset detect libupnp command buffer overflow attempts, and other rules cover specific vendor-firmware exploits in the same family, including a 2021 unauthenticated buffer overflow in DD-WRT (CVE-2021-27137) and command-injection vulnerabilities in D-Link SSDP handling (CVE-2025-10629 and CVE-2026-3485). Each successive disclosure follows the same pattern: a vendor’s UPnP implementation has a parsing bug, the bug is reachable without authentication, the firmware is widely deployed in consumer routers, and patching depends on whether the vendor still supports the affected model.
The amplification-DDoS story is independent of any specific implementation flaw. A small SSDP M-SEARCH request can elicit a response many times its own size from a UPnP device. An attacker spoofing the source address of an M-SEARCH request causes the response to flood the spoofed victim instead of the requester. SSDP became one of the most-abused amplification protocols on the internet during the mid-2010s, with tens of thousands of internet-exposed UPnP devices used as unwitting reflectors. A sample rule in our dataset detects SSDP M-SEARCH ssdp-all queries that match the pattern of amplification-DDoS reconnaissance.
Defensive practice for SSDP on the network edge is straightforward: UPnP and SSDP should never be reachable from the public internet. Consumer routers should not expose UDP/1900 on their WAN interface, and ISPs and home gateways increasingly block this traffic by default. Inside a managed network, UPnP is generally disabled where the auto-configuration model is not needed.
Inbound UDP/1900 from the public internet is a strong signal of either a misconfigured consumer device or a deliberate attempt to enumerate or exploit UPnP services. Outbound UDP/1900 from end-user devices to local-network multicast addresses is normal and constant on home networks; outbound UDP/1900 to public-internet addresses is uncommon and worth investigating.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).