How do you detect a rogue UPnP device?
A single machine can pose as every printer, router, and media player on your network. Here’s how to make it answer for a device that can’t exist.
You detect a rogue UPnP / SSDP device by asking the network for a device that cannot exist and seeing who answers. Genuine devices reply only for what they actually are, so a nonsense query gets silence. A catch-all rogue responder — the kind planted to lure you to a fake router login — answers everything, so it answers that too. Any reply is the tell.
Ask for something impossible, and see who lies.
How device discovery gets abused
SSDP (Simple Service Discovery Protocol) is how Windows finds UPnP devices — media players, printers, routers — by multicasting a question on UDP port 1900. Whatever answers is taken at face value and shown to you in the Network folder. That trust is the whole attack surface.
A rogue device runs a catch-all responder that answers every discovery query, each reply carrying an attacker-chosen name and a LOCATION URL — the address Windows fetches to learn about the “device.” The best-known tool for this is evil-ssdp:
# Attacker turns a machine on your network into a catch-all responder evil-ssdp -i eth0 -t microsoft-teams # Every reply advertises a malicious LOCATION URL: # LOCATION: http://<attacker>/present.html <- fake login / hash grab
What a rogue responder looks like
It hides among devices you’d half-expect to see, which is what makes it dangerous. Watch for:
- An unfamiliar device in your Network folder — an oddly-named “router,” “printer,” or media server nobody set up.
- A surprise “sign in to your router / printer” page that pops up when you browse the network.
- Chatter on UDP 1900 from a host that isn’t your real router.
- The same device answering for many types at once — a real printer doesn’t also claim to be a smart TV.
Flush it out with a nonsense query
Windows has no clean native SSDP-audit tool, so start with the visible symptoms — open the Network folder, check that the discovery services are the ones you expect, and confirm whether SSDP is even bound on this PC:
# Open the Network folder and look for devices you don't recognise explorer.exe shell:NetworkPlacesFolder # UPnP/SSDP discovery leans on these services -- confirm what's live Get-Service SSDPSRV, upnphost # Check whether SSDP is bound on UDP 1900 on THIS PC # (these show local sockets only, not other hosts on the network) Get-NetUDPEndpoint -LocalPort 1900 -ErrorAction SilentlyContinue netstat -an -p UDP | findstr 1900
The dependable move goes further: send a discovery query (an M-SEARCH to 239.255.255.250:1900) for a random, made-up device type. Nothing real will answer it — but a catch-all rogue answers everything, so any reply is a rogue responder, full stop. That’s the canary WifiThreatWatch runs for you, and it’s false-positive-proof by construction.
Why you can’t just eyeball it
The trap is that a rogue device looks exactly like a legitimate one — SSDP has no authentication, so Windows can’t tell a real printer’s reply from an attacker’s. “A device I don’t recognise” is a weak signal: new gadgets, guests, and forgotten printers all trip it.
The canary sidesteps all of that. Instead of judging whether a device looks trustworthy, it asks a question only a liar would answer. A reply to a query for a device that cannot exist isn’t ambiguous — it’s proof.
Catching it automatically
WifiThreatWatch runs the nonsense-device canary for you and flags any host that answers — naming the responder that replied to a query nothing real should touch. Because the signal is false-positive-proof, it stays quiet on healthy networks and speaks up only when a catch-all responder is present. Detection is free.
Go deeper: how we detect rogue SSDP responders · rogue devices on your network · the threats library
Rogue UPnP: quick answers
How do I detect a rogue UPnP / SSDP device?
Start by opening your Network folder (run “explorer.exe shell:NetworkPlacesFolder”) and looking for devices you don’t recognise — a rogue responder usually plants an oddly-named one. The reliable method is a canary probe: ask the network for a device type that cannot exist and see if anything answers. Real devices stay silent to a nonsense query; a catch-all rogue answers it, so any reply is the tell.
What is SSDP, and why is UDP port 1900 a target?
SSDP (Simple Service Discovery Protocol) is how Windows finds UPnP devices like media players, printers, and routers, using multicast on UDP port 1900. It’s trusting by design: whatever answers a discovery query is taken at face value and shown to you. That trust is exactly what a rogue responder abuses, answering every query with a device it made up.
What is evil-ssdp, or a “catch-all” responder?
evil-ssdp is a well-known tool that turns a machine on your network into a catch-all SSDP responder — it replies to every discovery query, no matter what was asked. Each reply carries an attacker-chosen name and a LOCATION URL pointing at a fake login page, a hash-capturing link, or a malware download. Because it answers everything, it also answers a query for a device that doesn’t exist, which is how you catch it.
Can a rogue SSDP device steal my Windows password?
It can try, in two ways. The LOCATION URL can point to a fake “sign in to your router or printer” page that captures whatever you type. Or it can point to a path that quietly prompts Windows to hand over your login hash on contact, which an attacker can then crack offline. Neither works if you don’t trust the fake device — which is why surfacing it early matters.
Is a strange device in my Network folder always an attack?
No. A new smart plug, a guest’s phone, or a printer you forgot about can all appear legitimately. That’s why the dependable signal isn’t “a device I don’t recognise” but “a device that answered a query for something impossible.” A real device never does that — so a reply to the canary is a rogue responder, not a false alarm.