Simple Service Discovery Protocol

The Simple Service Discovery Protocol (SSDP) is a network protocol based on the Internet protocol suite for advertisement and discovery of network services and presence information. It accomplishes this without assistance of server-based configuration mechanisms, such as Dynamic Host Configuration Protocol (DHCP) or Domain Name System (DNS), and without special static configuration of a network host. SSDP is the basis of the discovery protocol of Universal Plug and Play (UPnP) and is intended for use in residential or small office environments. It was formally described in an Internet Engineering Task Force (IETF) Internet Draft by Microsoft and Hewlett-Packard in 1999. Although the IETF proposal has since expired (April, 2000),[1] SSDP was incorporated into the UPnP protocol stack, and a description of the final implementation is included in UPnP standards documents.[2][3]

Internet protocol suite
Application layer
Transport layer
Internet layer
Link layer
  • more...

Protocol transport and addressing

SSDP is a text-based protocol based on HTTPU. It uses UDP as the underlying transport protocol. Services are announced by the hosting system with multicast addressing to a specifically designated IP multicast address at UDP port number 1900. In IPv4, the multicast address is 239.255.255.250[4] and SSDP over IPv6 uses the address set ff0X::c for all scope ranges indicated by X.[5]

This results in the following well-known practical multicast addresses for SSDP:

  • 239.255.255.250 (IPv4 site-local address)
  • [FF02::C] (IPv6 link-local)
  • [FF05::C] (IPv6 site-local)
  • [FF08::C] (IPv6 organization-local)
  • [FF0E::C] (IPv6 global)

Additionally, applications may use the source-specific multicast addresses derived from the local IPv6 routing prefix, with group ID C (decimal 12).

SSDP uses the HTTP method NOTIFY to announce the establishment or withdrawal of services (presence) information to the multicast group. A client that wishes to discover available services on a network, uses method M-SEARCH. Responses to such search requests are sent via unicast addressing to the originating address and port number of the multicast request.

Microsoft's IPv6 SSDP implementations in Windows Media Player and Server use the link-local scope address. Microsoft uses port number 2869 for event notification and event subscriptions. However, early implementations of SSDP also used port 5000 for this service.[6]

DDoS attack

In 2014 it was discovered that SSDP was being used in DDoS attacks known as an SSDP reflection attack with amplification. Many devices, including some residential routers, have a vulnerability in the UPnP software that allows an attacker to get replies from port number 1900 to a destination address of their choice. With a botnet of thousands of devices, the attackers can generate sufficient packet rates and occupy bandwidth to saturate links, causing the denial of services.[7] [8] [9] The network company Cloudflare has described this attack as the "Stupidly Simple DDoS Protocol".[10]

gollark: Just very short-range radio.
gollark: I think it's technically possible to do it, but impractical and hard and inefficient.
gollark: Use wireless components.
gollark: The CC community's OS obsession is unhealthy.
gollark: Milo's not an OS, it's an opus component.

See also


References
  1. IETF draft revision 3 (outdated and expired)
  2. "UPNP Device Architecture 1.1" (PDF). UPnP Forum. 2008-10-15. Archived from the original on 2015-11-07.CS1 maint: BOT: original-url status unknown (link)
  3. "UPnP Device Architecture v2.0" (PDF). upnp.org. February 20, 2015. Archived from the original on November 7, 2015.CS1 maint: BOT: original-url status unknown (link)
  4. "Internet Multicast Addresses". IANA. 2010-06-22.
  5. "Internet Protocol Version 6 Multicast Addresses". IANA. Retrieved 2010-08-10.
  6. Microsoft Knowledge Base Article 832017
  7. Guide to DDoS Attacks, pg 8
  8. "UDP-Based Amplification Attacks".
  9. SSDP generates 100 Gbps DDoS
  10. "Stupidly Simple DDoS Protocol (SSDP) generates 100 Gbps DDoS". The Cloudflare Blog. 2017-06-28. Retrieved 2019-10-13.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.