Traffic Is Sent After You Turn Off the SSDP Discover Service and Universal Plug and Play Device Host

Support for Windows XP has ended

Microsoft ended support for Windows XP on April 8, 2014. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article was previously published under Q317843
This article has been archived. It is offered "as is" and will no longer be updated.
SYMPTOMS
Windows uses the following Universal Plug and Play services:
  • The Simple Service Discovery Protocol (SSDP) discovery service: This service discovers Universal Plug and Play devices on your home network.
  • Universal Plug and Play Device Host: This service provides support to host Universal Plug and Play devices.
If you turn off both the SSDP discovery service and Universal Plug and Play Device Host, all SSDP traffic is not stopped; User Datagram Protocol (UDP) port 1900 traffic may be logged in firewall logs or packet filtering device logs. If you run a trace of the traffic, the following information is displayed in the data section of the packet:
SSDP: Method = M-SEARCH
SSDP: Uniform Resource Identifier = *
SSDP: HTTP Protocol Version = HTTP/1.1
SSDP: Host = 239.255.255.250:1900
SSDP: Search Target = urn:schemas-upnp-org:device:InternetGatewayDevice:1
SSDP: Mandatory Extension = "ssdp:discover"
SSDP: Maximum Wait = 3
CAUSE
This issue may occur if Windows Messenger is using the SSDP discovery process to determine if there is a upstream Internet gateway device. Windows Messenger does not use the built-in Universal Plug and Play services. Windows Messenger formats and sends the SSDP discovery messages.
RESOLUTION
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
To resolve this issue, configure the registry to turn off the discovery messages:
  1. Start Registry Editor (Regedt32.exe).
  2. Locate and click the following key in the registry:
    HKEY_LOCAL_MACHINE\Software\Microsoft\DirectPlayNATHelp\DPNHUPnP
  3. On the Edit menu, click Add Value, and then add the following registry value:
    Value name: UPnPMode
    Data type: REG_DWORD
    Value data: 2
  4. Quit Registry Editor.
NOTE: If you set UPnPMode to 2, Universal Plug and Play Network Address Translation (NAT) traversal discovery does not occur.
Properties

Article ID: 317843 - Last Review: 12/07/2015 08:58:02 - Revision: 3.2

Microsoft Windows XP Home Edition, Microsoft Windows XP Professional

  • kbnosurvey kbarchive kbprb KB317843
Feedback