How to get the WAN IP from a router using UPnP/SSDP

Solution 1:

You'll need to use tcpdump or something similar to see the reply or replies.

nc is looking for a reply from the endpoint you sent the request to. But the endpoint you sent the request to is a generic broadcast target. The reply will come not from a generic broadcast target but from the specific device that replies.

As nc's output says, it has connected to the broadcast target. So it's not going to see the replies that come from the replying devices.

Solution 2:

Although, this task is rather old, I post the answer, I was looking for, myself.

Your UPnP-reply posted the location "http://192.168.1.1:1780/InternetGatewayDevice.xml"

There you can get more info about data format. For my router: I got there more paths to xmls. Calling them, there is more UPnP info. resulting in this: I called:

POST /upnp/control?WANIPConnection HTTP/1.1
Host: 192.168.1.1
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#GetExternalIPAddress"
Accept-Language: de-de;q=1, de;q=0.5
Accept-Encoding: gzip
Content-Type: text/xml; charset="utf-8"
User-Agent: gupnp-universal-cp GUPnP/0.20.10 DLNADOC/1.50
Connection: Keep-Alive
Content-Length: 281

<?xml version="1.0"?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:GetExternalIPAddress xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"></u:GetExternalIPAddress></s:Body></s:Envelope>

and get as answer:

HTTP/1.1 200 OK
EXT:
Content-Type: text/xml; charset="utf-8"
Date: Tue, 04 Aug 2015 23:55:01 GMT
Server: servername/2.0 UPnP/1.0 UPnP-Device-Host/1.0
Content-Length: 380

<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
    <s:Body>
        <u:GetExternalIPAddressResponse xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
            <NewExternalIPAddress>123.123.123.123</NewExternalIPAddress>
        </u:GetExternalIPAddressResponse>
    </s:Body>
</s:Envelope>

I've got a lot of help from "UPnP Inspector"