tcpdump whitelist filter for UPnP

StackOverflow https://stackoverflow.com/questions/18613201

  •  27-06-2022
  •  | 
  •  

Question

How to capture all UPnP traffic with tcpdump? I’d like to use “white list” and to collect only UPnP traffic, not something else.

So have started and wrote this filter:

tcpdump -i eth0 -nevvv -s 0 '(udp port 1900) or (tcp port 2869)'

Used following info from Wikipedia:

  • UPnP uses UDP port 1900 and TCP port 2869.

How to elaborate the filter further?

Était-ce utile?

La solution

It's not quite as simple as that. SSDP (the discovery protocol) uses port 1900 (and apparently in some cases 2869) but the actual UPnP service can be on whatever port: SSDP is just a way to discover that port and other details about the service.

See UPnP Device Architecture spec (pdf) for more details.

Licencié sous: CC-BY-SA avec attribution
Non affilié à StackOverflow
scroll top