uPNP normal network chatter

I’ve setup Comodo to allow uPNP - added IP In (any port) for my router address under network and under rules svhost can send UDP out and accept TCP in for my router address too.

It seems to be working fine - router appears as a gateway in XP and I can configure its port mapping.

My question is, is it normal uPNP chatter to have 40-50 TCP in connections coming in from the router address to port 2869 ALL THE TIME. Each one packet is identical in size. I thought uPNP might just open up a single connection to 2869, not flood while running.

Anyone here who uses it know what is normal uPNP network chatter? I can’t find an answer by searching the net. :frowning:

The UPnP framework uses the Simple Service Discovery Protocol (SSDP) as a basis for communication between enabled devices. SSDP uses announcements (advertisements if you will) to let other aware devices on the network know of its presence. SSDP is also used to publish event notifications, i.e. if something changes, a subscribed control node can receive these notifications.

The traffic you’re seeing over TCP 2869 is basically these advertisements and event notifications.

If you’re interested, you can read more here

Thanks for the reply and link, I’ll have a read through as that’s the most detailed info I’ve seen so far.

I did read about how it worked on the net so I knew how to configure Comodo, just was suprised to see 40-50 incoming TCP connections on port 2869 with continuous frequency. Must be to provide continuous status updates.

If this is normal advertisement and event notification chatter from SSDP, then fine. :slight_smile:

Your mileage might vary regarding the frequency of notifications sent, but they are frequent. I don’t personally use SSDP or UPnP, so I disable the services, but if I enable them WallWatcher which I use to monitor my router logs, always captures a good number every minute.