Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just plugged in a couple tp-link wirless access points and found that while they work fine, I am now seeing traffic going from their internal ip's to a which is nothing on my network. Researching that ip, it looks like it might be related to ssdp? I looked through all the settings and see nothing about ssdp. I also turned off everything I could find in the ap - upnp, firewall, dhcp, etc. (I am only using it as a basic wireless access point on to the lan).

Any ideas?

share|improve this question
up vote 1 down vote accepted

This is indeed a multi-cast address used by ssdp. Among other things printers use this to advertize that they are IPP capable. Windows PC's can do this as well if the have the MS webserver (IIS) running.

Your access-points (and your internet facing router) simply send it along as they consider it normal outgoing traffic. (Most routers automatically block outgoing multi-casts when they are NATTING as it makes no sense to send this kind of traffic to the internet. Some routers are smart enough to block 224...* multi-cast, but let 239...* through.)

Contrary to popular believe this, by itself is NOT UPNP related. It is of course possible that a UPNP capable device used UPNP to tell the router to open the firewall for this traffic.

share|improve this answer
+1 Nice detailed answer – Dave M Jan 11 '12 at 14:51
Perhaps you have seen different equipment then I have, but in my experience no routers will do anything in the multicast range without configuration. – Zoredache Jan 11 '12 at 17:53
@zoredache: Most low-range consumer stuff doesn't bother filtering multicast at all. I have seen Sitecom, Linksys, D-Link, Netgear, TP, LevelOne, Zyxell and AVM/FrizBox all guilty of it. More serious equipment usually blocks but allows configuration (either though UPNP, managment interface or both). – Tonny Jan 11 '12 at 18:56
It is actually very much related to UPNP: is a "site-local address", which means packets adressed to it should never leave your network. – Dan Berindei Apr 15 '13 at 9:00
@DanBerindei You are right, but there are a lot of shitty implementations out there that just send it through. – Tonny Apr 15 '13 at 9:06

This is often associated with UPnP. The address is not a "valid" internet address but used for other purposes. Looking it up with WHOIS will report "reserved for special purposes" The traffic may be a device on your network using UPnP

share|improve this answer
Explain downvote please – Dave M Jan 11 '12 at 17:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.