Rogue WS-Discovery Device

The icons in the Windows Explorer Network folder — printers, scanners, NAS boxes, other PCs — mostly get there through WS-Discovery (WSD), a protocol that speaks SOAP-over-UDP on port 3702. When your PC opens that folder it multicasts a Probe — “who out there is a printer?” — and real devices answer with their name and a URL where Windows can fetch their details.

WSD is not the same protocol as SSDP. SSDP powers UPnP media and smart-home discovery; a rogue SSDP responder targets that. WSD is what fills the Network tab you actually click through in File Explorer, which is what makes a rogue WSD device so convincing.

A stranger just added a printer to your computer — and named it whatever they wanted.

A rogue WSD device is a catch-all responder: instead of answering only for the device type it actually is, it answers every Probe it hears. Ask for a printer, it’s a printer. Ask for a NAS, it’s a NAS. Whatever your PC is looking for, the rogue claims to be it — under an attacker-chosen name like “HP LaserJet — Front Desk.”

The payload is the metadata URL the fake device hands back. It can point at a phishing page dressed up as a printer login, a booby-trapped UNC path (\\attacker\share) that makes Windows cough up your login hash the instant it connects, or a plain malware lure. There’s no famous named tool — it’s a short catch-all responder script; a benign wsdd host is the honest control it perverts.

# Conceptual: a catch-all WSD responder (no famous named tool)
# Listen on UDP 3702; answer EVERY Probe, whatever Type it asks for
on Probe(any_device_type):
    reply(name = "HP LaserJet - Front Desk",
          xaddr = "http://attacker/meta")   # malicious metadata URL

We don’t try to tell a good device from a bad one — we ask a question only a rogue will answer. WifiThreatWatch sends a WS-Discovery Probe for a random, made-up device Type in a made-up namespace that no real product on earth implements.

A compliant printer, PC, or NAS answers only for its own type, so it stays silent — our nonsense Type means nothing to it. A catch-all rogue answers everything, so it answers our gibberish too. Any reply at all is, by construction, a rogue: there is no legitimate device that could match a Type we invented.

You can watch for it by hand, too. The tell is unfamiliar icons in the Explorer Network folder, and the traffic is UDP SOAP to the multicast address 239.255.255.250 on port 3702:

# Open the Network folder and eyeball every device you don't recognise
explorer.exe shell:NetworkPlacesFolder

# Capture the WS-Discovery traffic (SOAP-over-UDP, port 3702)
# pktmon is built into Windows 10/11 - run in an elevated prompt
pktmon filter add WSD -p 3702
pktmon start --etw -m real-time
# ...watch, then Ctrl-C, then clean up:
pktmon stop
pktmon filter remove

The danger of a rogue WSD device is the click — you trust the Network folder, so you open the fake printer and follow its link. WifiThreatWatch names the responder and flags it before you do, so you never hand it the click, the credentials, or the login hash it’s fishing for.

And because the whole trick rides on your PC reaching out and trusting what answers, an encrypted tunnel changes the odds on a hostile network: a subscription’s Active Defense routes your traffic through it, so a UNC lure or phishing metadata URL has far less to work with. Detection itself is free.