Why does my Mac have activity on port 1900?

SSDP (Simple Service Discovery Protocol) is a UDP broadcast/multicast protocol used by UPnP devices (smart TVs, Chromecasts, media servers, and IoT gadgets) to announce themselves on the local network. Apps like Chrome (for Cast support), Plex, and Spotify listen for these announcements to find nearby devices.

Is it safe to block port 1900?

Usually yes, if you don't use device discovery features like casting or DLNA media browsing. Blocking it just means those apps won't auto-discover devices on your network. It won't affect anything else.

Is port 1900 a security risk?

UPnP/SSDP has a history of being abused in DDoS reflection attacks when exposed to the public internet on routers, but that's a router-level concern, not something that applies to outbound SSDP traffic from your Mac on your own local network.

Port 1900: SSDP/UPnP Discovery Traffic Explained

Port 1900 isn’t a service you install; it’s UDP traffic from SSDP, the discovery protocol behind “cast to this device” and “browse this media server” features.

What typically listens on port 1900

UPnP/DLNA-aware apps: Chrome (Google Cast extension), Plex, VLC, Spotify, and various smart-home apps listen for SSDP announcements to find TVs, speakers, and media servers on your network.
Nothing malicious by default: A stock Mac isn’t running an SSDP service; you’ll see 1900 activity only when an app that uses device discovery is running.
IoT and smart-home devices: Chromecasts, smart TVs, and similar devices broadcast SSDP announcements on your network, which is what your Mac’s apps are picking up.

Is it safe to kill?

There’s rarely a persistent process to “kill” here in the way there is with a dev server. SSDP is mostly UDP broadcast traffic, not a long-running listener you’d normally need to shut down. If an app is using it and you want to stop it, quitting that app (Chrome, Plex, a smart-home app) stops its SSDP activity.

Is it suspicious?

On a home or office network with smart TVs, casting devices, or media servers, seeing SSDP traffic is completely normal. It becomes worth a second look mainly in the context of routers exposed to the public internet, where SSDP has historically been used in DDoS reflection attacks. That’s a router/network-edge issue, though, not something to worry about from your Mac’s own outbound traffic on a private network.

How to check port 1900 activity on macOS

lsof -i :1900

This shows which app on your Mac is sending or listening for SSDP traffic, which is usually enough to explain it: a browser, a media app, or a smart-home app you already have open.

Portie surfaces exactly which app owns any port, including UDP activity like this, so you don’t have to guess whether background network chatter is expected or worth a closer look.