CyberHunter
Local dataset, no network
// Network services

Port 1900: SSDP / UPnP

UPnP discovery.

1900

How SSDP / UPnP works

Network services
M-SEARCHme! M-SEARCHme!

A device asks the whole local network a question and the device that matches answers. It travels in clear text: anyone on the path can read it.

Transport
UDP · TCP
Exposure risk
6/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
Network services
01 Security

Is port 1900 dangerous?

Common attacks and weaknesses

  • DDoS amplification; routers opening ports automatically through UPnP.

How to secure it

  • Disable UPnP on routers and block SSDP at the edge.
02 Registry

IANA registry entries for port 1900

ServicePortTransportDescriptionReferenceUpdated
ssdp 1900 TCP, UDP SSDP - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 1900, and is it reachable?

Linux

sudo ss -ltnup 'sport = :1900'      # process listening on 1900
sudo lsof -nP -i :1900

macOS

sudo lsof -nP -i :1900

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 1900 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 1900
netstat -ano | findstr :1900

From another machine

nmap -p 1900 -sV <host>
sudo nmap -sU -p 1900 <host>
nc -zv <host> 1900

Block it in the firewall

sudo ufw deny 1900/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 1900" -Direction Inbound -LocalPort 1900 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 1900 used for?

UPnP discovery.

Is port 1900 TCP or UDP?

Port 1900 is registered for UDP and TCP. In practice the service mostly uses UDP.

Is it safe to open port 1900?

It is rated 6/10 (high) when exposed to the Internet. DDoS amplification; routers opening ports automatically through UPnP. Disable UPnP on routers and block SSDP at the edge.

How do I check if port 1900 is open?

On Linux run "ss -ltnup 'sport = :1900'", on macOS "lsof -nP -i :1900", and on Windows "netstat -ano | findstr :1900" to see the local process. From another machine, "nmap -p 1900 <host>" shows whether it is reachable.

05 Related
:53 DNS tcp · udp · moderate risk :135 MS RPC tcp · udp · high risk :123 NTP udp · tcp · moderate risk :67 DHCP server udp · tcp · moderate risk :111 rpcbind tcp · udp · high risk :9100 Raw printing (JetDirect) tcp · udp · high risk :631 IPP / CUPS tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk

Latest vulnerability news

All news