alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET SCAN External to Internal UPnP? Request udp port 1900"; content:"MSEARCH * HTTP/1.1"; depth:18; content:"MAN\: ssdp\:"; nocase; distance:0; classtype:attempted-recon; reference:url,www.upnp-hacks.org/upnp.html; sid:2008094; rev:2;)

Added 2008-04-03 15:40:10 UTC

From outside to your local net, but the TCP port 2555 version. This is not a normal discovery protocol, someone's trying to access your systems. Definitely needs attention!

-- MattJonkman - 03 Apr 2008

alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET SCAN External to Internal UPnP? Request udp port 1900"; content:"MSEARCH * HTTP/1.1"; depth:18; content:"MAN\: ssdp\:"; nocase; distance:0; classtype:attempted-recon; reference:url,www.upnp-hacks.org/upnp.html; sid:2008094; rev:2;)

Added 2008-04-03 15:40:10 UTC

alert udp !$HOME_NET any -> $HOME_NET 1900 (msg:"ET SCAN External to Internal UPnP? Request udp port 1900"; content:"MSEARCH * HTTP/1.1"; depth:18; content:"MAN\: ssdp\:"; nocase; distance:0; classtype:attempted-recon; reference:url,www.upnp-hacks.org/upnp.html; sid:2008094; rev:1;)

Added 2008-04-03 13:13:45 UTC