Port 1900 SSDP / UPnP · UDP

What runs on port 1900

SSDP: the discovery part of UPnP, multicast to 239.255.255.250:1900. Media players, smart TVs, printers, routers and game consoles announce themselves and respond to M-SEARCH. Routers that answer SSDP on their WAN side are a known reflection/amplification vector and also expose UPnP port-mapping (the "IGD" that lets any LAN device open ports from the outside).

Software that uses it: Windows (SSDP Discovery service) · miniupnpd (routers) · DLNA servers (Plex, Jellyfin, Kodi) · Sonos, Chromecast-era devices

Should port 1900 be open?

Private network or VPN only. Nothing good comes from this port being reachable from the internet. Keep it on an internal network, reach it over a VPN or an SSH tunnel, and firewall it from everything that does not need it.

• Block UDP 1900 inbound on the WAN and consider disabling UPnP on the router.
• gssdp-discover or "nmap -sU -p 1900 --script upnp-info" lists what is announcing.

Check port 1900

# on the host: is anything listening, and which process?
ss -lunp 'sport = :1900'
sudo lsof -i :1900

# from another machine: is it reachable?
nc -zuv host 1900
sudo nmap -sU -p 1900 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 1900

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 1900 proto udp
sudo ufw deny 1900/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 1900 accept
nft add rule inet filter input udp dport 1900 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 1900 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 1900 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=1900 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 1900" with no source is just "open".

Related ports

• 5353 mDNS — Bonjour / Avahi discovery
• 8200 Vault

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions