PORTLink-local onlyIANA assigned
Port 1900SSDP / UPnP discovery
Port 1900 is the UDP port for the Simple Service Discovery Protocol (SSDP), the discovery layer of Universal Plug and Play (UPnP). Windows, routers, smart TVs, game consoles and media servers use it to announce and find services on the local network. SSDP exposed to the internet is a well-known amplification vector and should be blocked at the edge.
What port 1900 is used for
SSDP is how UPnP devices say "here I am" and how controllers ask "who is here?". A device multicasts NOTIFY messages to 239.255.255.250:1900; a controller sends M-SEARCH to the same address and receives unicast replies listing each device's description URL. After discovery, control traffic moves to HTTP on whatever port the device advertises (2869 on Windows, various on other devices).
Things that rely on it: Windows Network discovery, media streaming (DLNA), game consoles requesting port forwards through UPnP IGD, smart TVs, Sonos, Chromecast setup, some printer installers.
Security considerations
- Internet-facing SSDP is an amplification vector. A 100-byte M-SEARCH can trigger a reply many times larger. Millions of routers have been found answering on 1900 from the WAN side; blocking it inbound at the edge is essential.
- UPnP IGD opens ports without authentication. Any process on the LAN, including malware, can ask the router to forward a port to it. Disable UPnP on the router if you do not need it, or at least review the forwards it has created.
- Device enumeration. SSDP replies reveal device models and firmware versions, useful to anyone on the LAN looking for something to exploit.
Checking on Windows
netstat -ano -p udp | findstr :1900
sc query SSDPSRVThe first shows the listener; the second shows whether the SSDP Discovery service is running.
Firewall considerations
Windows allows SSDP on the Private profile through the "Network Discovery" rule group; keep it disabled on Public. On the router, ensure UDP 1900 is not reachable from the WAN and consider disabling UPnP entirely.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 1900 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Should I disable UPnP on my router?
UPnP lets applications on the LAN open inbound ports on the router automatically, without authentication. That is convenient for games and convenient for malware. Disabling it is the safer default; re-enable only if a specific application needs it and you understand what it opens.
Why is svchost.exe listening on UDP 1900?
The Windows SSDP Discovery service (SSDPSRV) listens there to find network devices and media servers. It is normal on the Private profile and can be stopped if unwanted.