SSDP replies from 192.168.1.1. What exactly is at this ip address?

When I send a crafted ssdp request packet with ssdp:all to 239.255.255.250, an address 192.168.1.1 replies with a bunch of HTTP 1.1 OK ssdp messages(captured on Wireshark). Are these ssdp services that this device at that address is offering? What is at this address because I've seen it around in other home networks as well.

Solution 1:

SSDP is used to detect automatically network services. When you send a crafted SSDP request on a multicast address (such as 239.255.255.250), all devices providing this kind of services should respond with an SSDP "Notify" packet.

The data of these answer packets are structured like an HTTP header and contains information about the services provided by the host.

In your case, you receive answer from 192.168.1.1. This address is often used by the default Gateway of the network.

The default gateway of the network often provide UPnP services, especially for port mapping.