Traffic Is Sent After You Turn Off the SSDP Discover Service and Universal Plug and Play Device Host

Windows uses the following Universal Plug and Play services:

• The Simple Service Discovery Protocol (SSDP) discovery service: This service discovers Universal Plug and Play devices on your home network.
• Universal Plug and Play Device Host: This service provides support to host Universal Plug and Play devices.

If you turn off both the SSDP discovery service and Universal Plug and Play Device Host, all SSDP traffic is not stopped; User Datagram Protocol (UDP) port 1900 traffic may be logged in firewall logs or packet filtering device logs. If you run a trace of the traffic, the following information is displayed in the data section of the packet:

This issue may occur if Windows Messenger is using the SSDP discovery process to determine if there is a upstream Internet gateway device. Windows Messenger does not use the built-in Universal Plug and Play services. Windows Messenger formats and sends the SSDP discovery messages.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: To resolve this issue, configure the registry to turn off the discovery messages:

1. Start Registry Editor (Regedt32.exe).
2. Locate and click the following key in the registry:
   HKEY_LOCAL_MACHINE\Software\Microsoft\DirectPlayNATHelp\DPNHUPnP
3. On the Edit menu, click Add Value, and then add the following registry value:
   Value name: UPnPMode
   Data type: REG_DWORD
   Value data: 2
4. Quit Registry Editor.

NOTE: If you set UPnPMode to 2, Universal Plug and Play Network Address Translation (NAT) traversal discovery does not occur.