This wiki has been migrated to and is now deprecated. Please use that site instead.

Simple Service Discovery Protocol (SSDP)

The SSDP protocol can discover Plug & Play devices, with uPnP (Universal Plug and Play). SSDP uses unicast and multicast adress ( SSDP is HTTP like protocol and work with NOTIFY and M-SEARCH methods.

SSDP can be used over IPv4 and IPv6.


IETF Draft Revision 3

IETF Draft Revision 2

Protocol dependencies

Example traffic


The SSDP dissector is based on the HTTP one. Since Wireshark 2.2, one can use the ssdp display filter.

In older versions one can use the http filter, but that would show both HTTP and SSDP traffic. To restrict the capture, one can:

Preference Settings

SSDP has no preference setting.

Example capture file

Nothing yet

Display Filter

 udp.dstport == 1900


In Wireshark versions before 2.2, there was no special ssdp filter and one has to use http instead.

All UDP packets containing HTTP header:

udp contains "HTTP/1.1"

All UDP packets containing both HTTP header and UPnP search type header ("\nST:"), eg. UPnP search request:

(udp contains "HTTP/1.1") and (udp contains 0a:53:54:3a)

Capture Filter


SSDP (last edited 2016-09-10 21:08:44 by PeterWu)