0

While reviewing firewall logs that were sent to me from a Windows 7 box (the box is not a server) on a tiny network, I saw thousands of incoming SSDP UDP entries. The SSDP entries were nearly constant, occurring every 3 seconds (approx 1200 log entries per hour). The last time I was asked to review the logs for that network, I don't recall seeing such traffic.

The firewall log shows the SSDP traffic as incoming. As expected, the protocol is UDP. It is almost all coming from ::1 (loopback) over a single dynamic port (49152 - 65535) with a destination address of ff02::c (IPv6 link-local), port 1900. The SSDPSRV service of Windows is the Windows service handling the requests.

Is this type of traffic normal for networks containing a Win7 box?

If not, what should be attempted to fix the issue?

1 Answer 1

1

Is this type of traffic normal for networks containing a Win7 box?

I'd expect to see it on any network that has Windows computers.

What should be attempted to fix the issue?

Disable and stop the SSDP Discovery service on your Windows computers.

1
  • Thanks Joe. It seems like the SSDP service on the box is interrogating itself. Am I misinterpreting the log, or is that basically what it is doing? Is that normal? Nov 24, 2020 at 21:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .