The SSDP protocol can discover Plug & Play devices, with uPnP (Universal Plug and Play). SSDP uses unicast and multicast adress (18.104.22.168). SSDP is HTTP like protocol and work with NOTIFY and M-SEARCH methods.
SSDP can be used over IPv4 and IPv6.
- SSDP uses UDP transport protocol on port 1900
The SSDP dissector is based on the HTTP one. Since Wireshark 2.2, one can use the
ssdp display filter.
In older versions one can use the
http filter, but that would show both HTTP and SSDP traffic. To restrict the capture, one can:
- filter with the destination port (see Display filter)
- or filter based on packet contents (see Display filter)
SSDP has no preference setting.
udp.dstport == 1900
In Wireshark versions before 2.2, there was no special
ssdp filter and one has to use
All UDP packets containing HTTP header:
udp contains "HTTP/1.1"
All UDP packets containing both HTTP header and UPnP search type header ("\nST:"), eg. UPnP search request:
(udp contains "HTTP/1.1") and (udp contains 0a:53:54:3a)
udp port 1900
Imported from https://wiki.wireshark.org/SSDP on 2020-08-11 23:25:52 UTC