Simple Service Discovery Protocol (SSDP)
The SSDP protocol can discover Plug & Play devices, with uPnP (Universal Plug and Play). SSDP uses unicast and multicast adress (220.127.116.11). SSDP is HTTP like protocol and work with NOTIFY and M-SEARCH methods.
SSDP can be used over IPv4 and IPv6.
- SSDP uses UDP transport protocol on port 1900
The SSDP dissector is based on the HTTP one. Since Wireshark 2.2, one can use the ssdp display filter.
In older versions one can use the http filter, but that would show both HTTP and SSDP traffic. To restrict the capture, one can:
- filter with the destination port (see Display filter)
- or filter based on packet contents (see Display filter)
SSDP has no preference setting.
Example capture file
udp.dstport == 1900
In Wireshark versions before 2.2, there was no special ssdp filter and one has to use http instead.
All UDP packets containing HTTP header:
udp contains "HTTP/1.1"
All UDP packets containing both HTTP header and UPnP search type header ("\nST:"), eg. UPnP search request:
(udp contains "HTTP/1.1") and (udp contains 0a:53:54:3a)
udp port 1900