/ GUIDE — NETWORK SECURITY

How do you detect a rogue UPnP device?

A single machine can pose as every printer, router, and media player on your network. Here’s how to make it answer for a device that can’t exist.

You detect a rogue UPnP / SSDP device by asking the network for a device that cannot exist and seeing who answers. Genuine devices reply only for what they actually are, so a nonsense query gets silence. A catch-all rogue responder — the kind planted to lure you to a fake router login — answers everything, so it answers that too. Any reply is the tell.

Ask for something impossible, and see who lies.
/ THE BASICS

How device discovery gets abused

SSDP (Simple Service Discovery Protocol) is how Windows finds UPnP devices — media players, printers, routers — by multicasting a question on UDP port 1900. Whatever answers is taken at face value and shown to you in the Network folder. That trust is the whole attack surface.

A rogue device runs a catch-all responder that answers every discovery query, each reply carrying an attacker-chosen name and a LOCATION URL — the address Windows fetches to learn about the “device.” The best-known tool for this is evil-ssdp:


# Attacker turns a machine on your network into a catch-all responder
evil-ssdp -i eth0 -t microsoft-teams

# Every reply advertises a malicious LOCATION URL:
#   LOCATION: http://<attacker>/present.html  <- fake login / hash grab
/ THE SIGNS

What a rogue responder looks like

It hides among devices you’d half-expect to see, which is what makes it dangerous. Watch for:

  • An unfamiliar device in your Network folder — an oddly-named “router,” “printer,” or media server nobody set up.
  • A surprise “sign in to your router / printer” page that pops up when you browse the network.
  • Chatter on UDP 1900 from a host that isn’t your real router.
  • The same device answering for many types at once — a real printer doesn’t also claim to be a smart TV.
/ DETECTION

Flush it out with a nonsense query

Windows has no clean native SSDP-audit tool, so start with the visible symptoms — open the Network folder, check that the discovery services are the ones you expect, and confirm whether SSDP is even bound on this PC:


# Open the Network folder and look for devices you don't recognise
explorer.exe shell:NetworkPlacesFolder

# UPnP/SSDP discovery leans on these services -- confirm what's live
Get-Service SSDPSRV, upnphost

# Check whether SSDP is bound on UDP 1900 on THIS PC
# (these show local sockets only, not other hosts on the network)
Get-NetUDPEndpoint -LocalPort 1900 -ErrorAction SilentlyContinue
netstat -an -p UDP | findstr 1900

The dependable move goes further: send a discovery query (an M-SEARCH to 239.255.255.250:1900) for a random, made-up device type. Nothing real will answer it — but a catch-all rogue answers everything, so any reply is a rogue responder, full stop. That’s the canary WifiThreatWatch runs for you, and it’s false-positive-proof by construction.

/ WHY IT’S HARD

Why you can’t just eyeball it

The trap is that a rogue device looks exactly like a legitimate one — SSDP has no authentication, so Windows can’t tell a real printer’s reply from an attacker’s. “A device I don’t recognise” is a weak signal: new gadgets, guests, and forgotten printers all trip it.

The canary sidesteps all of that. Instead of judging whether a device looks trustworthy, it asks a question only a liar would answer. A reply to a query for a device that cannot exist isn’t ambiguous — it’s proof.

/ THE TOOL

Catching it automatically

WifiThreatWatch runs the nonsense-device canary for you and flags any host that answers — naming the responder that replied to a query nothing real should touch. Because the signal is false-positive-proof, it stays quiet on healthy networks and speaks up only when a catch-all responder is present. Detection is free.

FREE FOREVERRogue SSDP detection is free, for Windows.

Go deeper: how we detect rogue SSDP responders · rogue devices on your network · the threats library

/ FAQ

Rogue UPnP: quick answers

How do I detect a rogue UPnP / SSDP device?

Start by opening your Network folder (run “explorer.exe shell:NetworkPlacesFolder”) and looking for devices you don’t recognise — a rogue responder usually plants an oddly-named one. The reliable method is a canary probe: ask the network for a device type that cannot exist and see if anything answers. Real devices stay silent to a nonsense query; a catch-all rogue answers it, so any reply is the tell.

What is SSDP, and why is UDP port 1900 a target?

SSDP (Simple Service Discovery Protocol) is how Windows finds UPnP devices like media players, printers, and routers, using multicast on UDP port 1900. It’s trusting by design: whatever answers a discovery query is taken at face value and shown to you. That trust is exactly what a rogue responder abuses, answering every query with a device it made up.

What is evil-ssdp, or a “catch-all” responder?

evil-ssdp is a well-known tool that turns a machine on your network into a catch-all SSDP responder — it replies to every discovery query, no matter what was asked. Each reply carries an attacker-chosen name and a LOCATION URL pointing at a fake login page, a hash-capturing link, or a malware download. Because it answers everything, it also answers a query for a device that doesn’t exist, which is how you catch it.

Can a rogue SSDP device steal my Windows password?

It can try, in two ways. The LOCATION URL can point to a fake “sign in to your router or printer” page that captures whatever you type. Or it can point to a path that quietly prompts Windows to hand over your login hash on contact, which an attacker can then crack offline. Neither works if you don’t trust the fake device — which is why surfacing it early matters.

Is a strange device in my Network folder always an attack?

No. A new smart plug, a guest’s phone, or a printer you forgot about can all appear legitimately. That’s why the dependable signal isn’t “a device I don’t recognise” but “a device that answered a query for something impossible.” A real device never does that — so a reply to the canary is a rogue responder, not a false alarm.

Every device, all at once.
That’s the one that shouldn’t be there.