Traffic Is Sent After You Turn Off the SSDP Discover Service and Universal Plug and Play Device Host (317843)

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

Windows uses the following Universal Plug and Play services:

The Simple Service Discovery Protocol (SSDP) discovery service: This service discovers Universal Plug and Play devices on your home network.
Universal Plug and Play Device Host: This service provides support to host Universal Plug and Play devices.

If you turn off both the SSDP discovery service and Universal Plug and Play Device Host, all SSDP traffic is not stopped; User Datagram Protocol (UDP) port 1900 traffic may be logged in firewall logs or packet filtering device logs. If you run a trace of the traffic, the following information is displayed in the data section of the packet:

SSDP: Method = M-SEARCH
SSDP: Uniform Resource Identifier = *
SSDP: HTTP Protocol Version = HTTP/1.1
SSDP: Host = 239.255.255.250:1900
SSDP: Search Target = urn:schemas-upnp-org:device:InternetGatewayDevice:1
SSDP: Mandatory Extension = "ssdp:discover"
SSDP: Maximum Wait = 3

CAUSE

This issue may occur if Windows Messenger is using the SSDP discovery process to determine if there is a upstream Internet gateway device. Windows Messenger does not use the built-in Universal Plug and Play services. Windows Messenger formats and sends the SSDP discovery messages.

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
To resolve this issue, configure the registry to turn off the discovery messages:

Start Registry Editor (Regedt32.exe).
Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\DirectPlayNATHelp\DPNHUPnP
On the Edit menu, click Add Value, and then add the following registry value:
Value name: UPnPMode
Data type: REG_DWORD
Value data: 2
Quit Registry Editor.

NOTE: If you set UPnPMode to 2, Universal Plug and Play Network Address Translation (NAT) traversal discovery does not occur.