tcpdump whitelist filter for UPnP

StackOverflow https://stackoverflow.com/questions/18613201

  •  27-06-2022
  •  | 
  •  

문제

How to capture all UPnP traffic with tcpdump? I’d like to use “white list” and to collect only UPnP traffic, not something else.

So have started and wrote this filter:

tcpdump -i eth0 -nevvv -s 0 '(udp port 1900) or (tcp port 2869)'

Used following info from Wikipedia:

  • UPnP uses UDP port 1900 and TCP port 2869.

How to elaborate the filter further?

도움이 되었습니까?

해결책

It's not quite as simple as that. SSDP (the discovery protocol) uses port 1900 (and apparently in some cases 2869) but the actual UPnP service can be on whatever port: SSDP is just a way to discover that port and other details about the service.

See UPnP Device Architecture spec (pdf) for more details.

라이센스 : CC-BY-SA ~와 함께 속성
제휴하지 않습니다 StackOverflow
scroll top