Heavy Multicast Traffic

Question

Having sniffed my SOHO network's I notice the heaviest burden from multicast addresses relating to UPNP services.

There is 1 external drive on the network. Am I correct in thinking the networked drive would be using SMB2 rather than SSDP?

Is it normal for UPNP to multicast, frequently, using SSDP and of varying packet length's?

I'd be inclined to just disable UPnP & as Ramhound says, SMB2 is years out of date & shouldn't be used. — Tetsujin, Sep 08 '21 at 08:54
I did have it disabled but could not get detect my external drive (it is usb'd into the router). Im disabling smb currently — ChristAHFER, Sep 08 '21 at 09:00
"SSDP is the basis of the discovery protocol of Universal Plug and Play (UPnP)" https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol - yeah, I'd say that's possible. To find out look at the source/destination addresses and port numbers of the packets. Or just disconnect it for a moment, you'll see the effect within seconds. Now my question is "why"... do you have some network performance issues or something alike you think could be related to the UPnP traffic? — Peregrino69, Sep 08 '21 at 09:01
It's important to quantify "heaviest burden" with respect to network capacity - UPNP is extremely chatty, and in particular with Apple hardware, you'll see **lots** of packets. While in a normal SOHO network, usually nothing much else goes on. But that's the normal situation and nothing you need to change, the network is using only a small fraction of its capacity for this UPNP traffic. So unless it's taking up significant capacity in your case, leave it as it is. — dirkt, Sep 08 '21 at 09:39
@harrymc Multicast address. Am I right in thinking I do not need UPNP for my Attached Network storage? (attached to the router via USB) — ChristAHFER, Sep 08 '21 at 09:50
UPNP is only required if the attached device is also a media server. It's not required for simple disk storage. — harrymc, Sep 08 '21 at 09:54
@Ramhound What should be used as an alternative and how should I enforce it? WIN10 home — ChristAHFER, Sep 08 '21 at 10:45

u1686_grawity · Accepted Answer · 2021-09-09T12:32:50.757

Is it normal for UPNP to multicast, frequently, using SSDP and of varying packet length's?

Yes, service discovery is an integral part of UPnP (it's literally in the name: "universal plug-and-play"). Some of those packets probably come from different devices, either advertising or searching for different service types. The SSDP packets contain text, so you can just look inside to see what's happening.

However, the expected rate (from a single device) should be somewhere along the lines of "a few times per minute" – aside from the initial burst of packets when the service starts up, it should not repeat the same thing every second.

Though if you have many devices hosting or searching for UPnP services, it may add up – but it should still not grow above several KB/s, i.e. it might be "heaviest burden" on an otherwise completely idle network, but not overwhelm unicast communications.

There is 1 external drive on the network. Am I correct in thinking the networked drive would be using SMB2 rather than SSDP?

No; those protocols achieve different things. SSDP is used for service discovery via multicast while SMB2 makes the direct connection for file transfer. To be specific, SMB2 does not have any form of discovery, it always relies on an external protocol.

But SSDP isn't the discovery protocol used together with SMB2 – that's WS-Discovery (aka WSD), which uses the same IP multicast group but a different UDP port (3702 vs 1900).

Instead, SSDP is mainly used for "appliance" discovery. For example, most home routers host the UPnP IGD "Internet Gateway Device" service (which apps use for automated port-forwarding); a NAS might host UPnP "Media Server"; and a TV or a Chromecast may advertise itself as a UPnP "Media Renderer" – those are discoverable via SSDP.

Heavy Multicast Traffic

1 Answers1