What is UPnP and how does it work?

UPnP fa­cil­i­tates the net­work­ing of network or mul­ti­func­tion devices such as computers, smart­phones, hard drives, or smart TVs. However, if you activate UPnP in a network, you should also be aware of the risks.

Plug and play every­where - that’s the best de­scrip­tion of Universal Plug and Play we can think of, ab­bre­vi­at­ed as UPnP. Anyone who uses devices with an assigned IP at home can connect them with UPnP re­gard­less of the man­u­fac­tur­er, retrieve media from a UPnP server ef­fort­less­ly, and access files across devices. UPnP was orig­i­nal­ly developed as a bundle of protocols by Microsoft and has been under de­vel­op­ment by the Open Con­nec­tiv­i­ty Foun­da­tion (OCF) since 2016. The standard includes multicast addresses and protocols such as IP, UDP, HTTP, XML, TCP, and SOAP.

The way UPnP works is simple. The activated UPnP standard makes it possible to au­to­mat­i­cal­ly identify network-com­pat­i­ble devices with their own IP address via control software and to access them from other devices. The control software is either pre-installed in the network device or down­loaded af­ter­wards. You no longer need to actively connect to devices thanks to UPnP, as they offer their services directly and grant access to files. This applies to music and videos on a PC that you access via a cell phone or movies on a computer that you stream via the smart TV.

The sequence and structure of UPnP requests usually looks like this:

1. Ad­dress­ing: In an IP network, network-enabled devices usually receive their IP address via the router and can be found and used in the UPnP network.
2. Discovery: The UPnP device uses the SSDP (Simple Service Discovery Protocol) to identify itself to other devices and control points in the network and is localized via UDP (User Datagram Protocol).
3. De­scrip­tion: The control point retrieves device de­scrip­tions via the HTTP protocol as an XML file con­tain­ing details of man­u­fac­tur­er, serial number, driver in­for­ma­tion, and pre­sen­ta­tion, control, and event URLs.
4. Control: Cross-device com­mu­ni­ca­tion takes place via the SOAP protocol, which is used to send messages to the device URLs to enable remote control.
5. Event Control: To avoid always having to actively query the status of services and other devices, UPnP devices use sub­scribed event messages by means of GENA (General Event No­ti­fi­ca­tion Ar­chi­tec­ture).
6. Pre­sen­ta­tion: The pre­sen­ta­tion URLs (contained in the de­scrip­tion XML file of a device) can be used to access other devices from the web browser as an al­ter­na­tive to UPnP.

A defining feature of UPnP is that each as­so­ci­at­ed device must have an IP address and control software. In addition, a device in the network can only offer access to data if it acts as a UPnP server with an active UPnP function or software. The control software enables cross-device UPnP com­mu­ni­ca­tion and data transfer via TCP, HTTP, or DLNA protocols. Since not every device has pre-installed control software, it may be necessary to install ap­pro­pri­ate apps on the smart­phone that can access UPnP servers and load media from a PC or network hard drive.

To set up a Windows computer as a UPnP server, it is also necessary to install control software such as Universal Media Server. Meanwhile, Windows Media Player also has the function to make the computer a UPnP server. As a UPnP server, the device enables access to files from the PC from other end devices, e.g. via the VLC Media Player on smart­phones or certain smart TVs. UPnP also ensures that as­so­ci­at­ed USB devices and hard drives are au­to­mat­i­cal­ly detected when you plug them into a device.

It takes only a few steps to enable UPnP in Windows and make files available ex­ter­nal­ly. To do this, enter the search term “Media streaming options” in the Windows search, open the search result and then click “Enable media streaming”. You may still need to confirm the process as an ad­min­is­tra­tor. If special software such as the Universal Media Server is already installed, the UPnP function is au­to­mat­i­cal­ly taken over by the control software.

The UPnP function is disabled on Windows by default for a reason. The free and device-in­de­pen­dent access to files from a UPnP server also poses dangers. These include:

• DSL routers with the UPnP function enabled allow instant mes­sen­gers and file-sharing apps to forward files to the local network without au­then­ti­ca­tion.
• Port sharing by UPnP devices may allow devices to be accessed from the Internet.
• Ports that are open to the outside world are quickly exploited by malware or botnets for DDoS attacks.

It is generally advised to disable the UPnP function, es­pe­cial­ly on routers, and to ensure that port sharing via UPnP is not possible.

Various media players, including UPnP players, make it possible to access playable media such as music, videos or even pictures from smart­phones, tablets, or laptops. However, to access the files of another device, it must already function as a UPnP server. Among the best-known UPnP-enabled media players, which are available as apps for smart­phones, desktops, or smart TVs, is the VLC Media Player. Other UPnP media players are:

• Plex (Windows, macOS, Linux)
• MusPnP (Windows, macOS, Linux)
• Me­di­a­Mon­key (Windows, Android)
• Kodi (Windows, macOS, Linux, Android, iOS)
• Banshee (Windows, macOS, Linux)

To turn a device into a UPnP server, programs such as Universal Media Server or Wild Media Server are suitable. Windows systems from Windows Media Player 11 onwards have a built-in UPnP server function.