SSDP

Simple Service Discovery Protocol (SSDP)

The SSDP protocol can discover Plug & Play devices, with uPnP (Universal Plug and Play). SSDP uses unicast and multicast adress (239.255.255.250). SSDP is HTTP like protocol and work with NOTIFY and M-SEARCH methods.

SSDP can be used over IPv4 and IPv6.

History

IETF Draft Revision 3

IETF Draft Revision 2

Protocol dependencies

Example traffic

trafic_ssdp.png

Wireshark

The SSDP dissector is based on the HTTP one. Since Wireshark 2.2, one can use the ssdp display filter.

In older versions one can use the http filter, but that would show both HTTP and SSDP traffic. To restrict the capture, one can:

Preference Settings

SSDP has no preference setting.

Example capture file

Nothing yet

Display Filter

 udp.dstport == 1900
 ssdp

In Wireshark versions before 2.2, there was no special ssdp filter and one has to use http instead.

All UDP packets containing HTTP header:

udp contains "HTTP/1.1"

All UDP packets containing both HTTP header and UPnP search type header ("\nST:"), eg. UPnP search request:

(udp contains "HTTP/1.1") and (udp contains 0a:53:54:3a)

Capture Filter

 udp port 1900

External links

Discussion


Imported from https://wiki.wireshark.org/SSDP on 2020-08-11 23:25:52 UTC