Common attacks and weaknesses
- DDoS amplification; routers opening ports automatically through UPnP.
Port 1900: SSDP / UPnP
UPnP discovery.
1900
How SSDP / UPnP works
Network servicesA device asks the whole local network a question and the device that matches answers. It travels in clear text: anyone on the path can read it.
- Transport
- UDP · TCP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Network services
Is port 1900 dangerous?
How to secure it
- Disable UPnP on routers and block SSDP at the edge.
IANA registry entries for port 1900
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ssdp | 1900 | TCP, UDP | SSDP | - | - |
// source: IANA service name and port number registry
Which program uses port 1900, and is it reachable?
Linux
sudo ss -ltnup 'sport = :1900' # process listening on 1900
sudo lsof -nP -i :1900macOS
sudo lsof -nP -i :1900
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 1900 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 1900 netstat -ano | findstr :1900
From another machine
nmap -p 1900 -sV <host> sudo nmap -sU -p 1900 <host> nc -zv <host> 1900
Block it in the firewall
sudo ufw deny 1900/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 1900" -Direction Inbound -LocalPort 1900 -Protocol TCP -Action Block # Windows
What is port 1900 used for?
UPnP discovery.
Is port 1900 TCP or UDP?
Port 1900 is registered for UDP and TCP. In practice the service mostly uses UDP.
Is it safe to open port 1900?
It is rated 6/10 (high) when exposed to the Internet. DDoS amplification; routers opening ports automatically through UPnP. Disable UPnP on routers and block SSDP at the edge.
How do I check if port 1900 is open?
On Linux run "ss -ltnup 'sport = :1900'", on macOS "lsof -nP -i :1900", and on Windows "netstat -ano | findstr :1900" to see the local process. From another machine, "nmap -p 1900 <host>" shows whether it is reachable.
Other network services ports
:53 DNS tcp · udp · moderate risk :135 MS RPC tcp · udp · high risk :123 NTP udp · tcp · moderate risk :67 DHCP server udp · tcp · moderate risk :111 rpcbind tcp · udp · high risk :9100 Raw printing (JetDirect) tcp · udp · high risk :631 IPP / CUPS tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk