uPnP

Universal Plug And Play

Uses TCP/IP, HTTP, XML, and SOAP to have devices automatically discover/control/configure each other over the network. The most common uses are DLNA uPnp Media Servers, and Automatic Port Forwarding Configuration (NAT Traversal).

How it works

My favorite description of how uPnP works is here - http://www.upnp-hacks.org/upnp.html. ssdp:discover (Simple Service Discovery Protocol) M-SEARCH Messages are sent over UDP multicast 239.255.255.250 port 1900. Using uPNP Develeoper Tools we can use the device sniffer to see the SSDP messages running around our network. We can also see lots of ssdp:alive NOTIFY messages with the LOCATION specifying the URL to get the soap wsdl xml for each device. Within the XML there are service nodes for each service supported by the device. Within each service node the SCPDURL is a relative URL to an xml description of the methods supported by the service. Using Device Spy we can browse all uPnp Devices on our network, determine their services, and even issue commands to them.

Windows Media Player Sharing

Every windows 7 PC on my LAN has a uPnP AV media server running as Windows Media Player Sharing device. Even though I can discover these devices I can't seem to access any of the media on them. To control the windows media server go to Control Panel, Network and Sharing Center, Advanced sharing settings. From here we can see windows 7 and window 8 by default have network discovery (SSDP) on. It seems however Microsoft did bolt some security on to uPnP. To control who can access your media files Media Streaming click on Choose Media Streaming Options, Turn On Media Streaming and then select which computers on your LAN can access your media files.

If we open windows media player, click on stream, and check allow remote control of my player - we can use Play To to Play Videos on other windows 7/8 boxes. Funny thing is I think windows 8 might have removed play to command functionality. It seems while windows 8 can be controlled, it can't be the controller. In order to work windows media player does need to be open on the target machine, WMP will not auto start.

uPnP Media Server has three uPnP services that show up under Computer Name\User Name

1. ConnectionManager
   GetProtocolInfo(), GetCurrentConnectionIDs(), GetCurrentConnectionInfo(),
2. ContentDirectory
   GetSearchCapabilities(), GetSortCapabilities(), GetSystemUpdateID(), Browse(), Search(), UpdateObject(), X_GetRemoteSharingStatus()
3. X_MS_MediaReceiverRegistrar
   IsAuthorized(), IsValidated(), RegisterDevice()

If windows media player is running we see a Windows Media Player Device with more services

1. ConnectionManager
   GetProtocolInfo(), GetCurrentConnectionIDs(), GetCurrentConnectionInfo(),
2. AVTransport
   SetAVTransportURI(), GetMediaInfo(), GetTransportInfo(), GetPositionInfo(), GetDeviceCapabilities(), GetTransportSettings(), Stop(), Play(), Pause(), Seek(), Next(), Previous(), GetCurrentTransportActions()
3. RenderingControl
   ListPresets(), SelectPreset(), GetMute(), SetMute(), GetVolume(), SetVolume()

Security

Many say the uPnP is insecure and should be turned off on the router. The biggest security flaw is that some routers have exposed uPnP commands to the wan (the internet) and keep them exposed even with uPnP turned off in the web interface. Go to shields up to see if your router has this major problem. Another problem with uPnP is the fact that there is no security in the protocol. If you get malware within your lan it can always connect to your router and possibly reconfigure it to expose your lan to the wan. For example you need a password to log in to the router UI, but there is no password required to send control commands through uPnP. Next I go on figuring out what can be controlled/configured through uPnp on my RT-N66U Router here.