Question Is it normal to have the SSDP protocol running on my LAN ?

[derek wildstar]

hi,
I installed Ntopng as a docker container in my server. I see that the SSDP is active.
I didn't even know that such a SSDP protocol was a thing, so I looked it up.
It seems to be useful to discover devices on our own LAN automatically.
So, Is it nomal having the SSDP protocol running on my LAN which shows also a remote IP in list other than just my devices' LAN IP?
Thanks

 

[COLGeek]

So others know what SSDP does: https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol

Yes, it can be a normal thing.

Have you looked up the remote address? Also, have you scanned this system for malware?

 

[derek wildstar]

So others know what SSDP does: https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol

Yes, it can be a normal thing.

Have you looked up the remote address? Also, have you scanned this system for malware?

https://who.is/whois-ip/ip-address/239.255.255.250

Thanks

 

[bill001g]

239.x.x.x ip addresses are multicast addresses. Multicast was never implemented on the internet. In addition the 239 range is restricted to local use so it can not leave your network even if there was some multicast network on the internet.

 

[derek wildstar]

239.x.x.x ip addresses are multicast addresses. Multicast was never implemented on the internet. In addition the 239 range is restricted to local use so it can not leave your network even if there was some multicast network on the internet.

Ok, thanks.
I'd like to figure out which service/program does multicast now

 

[bill001g]

You can likely see it in the network tab of the resource manager. Not sure if multicast is tracked the same way as more normal sessions.