What Is Universal Plug And Play (UPnP)?

A pair of hands holding a red CAT5 Ethernet cable with a glowing connector
Universal Plug and Play (UPnP) automates the steps required to allow devices to communicate with each other over a network. Yagi Studio / Getty Images

Universal Plug and Play is a set of protocols and related technologies that allow devices to automatically discover one another.

How Does Universal Plug and Play Work?

It used to be a huge pain to set up something like a printer. Now, thanks to UPnP, once your Wi-Fi printer is turned on, your laptop, tablet, and smartphone can see it.

Universal Plug and Play–not to be confused with Plug and Play (PnP)–is considered an extension of Plug and Play. When it all works correctly, it automates all of the complex steps required to allow devices to communicate with each other, be it directly (peer-to-peer) or over a network.

If you want to know a little more detail, read on. But be warned, it's a little nerdy.

Universal Plug and Play uses standard networking/internet protocols (e.g. TCP/IP, HTTP, DHCP) to support zero-configuration (sometimes referred to as ‘invisible’) networking. This means that when a device joins or creates a network, Universal Plug and Play automatically:

  • Assigns an IP address to the device and announces the device’s name/presence to the network
  • Describes the device’s capabilities/services (e.g. printer, scanner) and availability to the network
  • Shares the names and capabilities of all other devices currently on the network
  • Sets control points so that actions can be requested of services (e.g. starting/cancelling a print job)
  • Updates the state of the device’s services (if running)
  • Provides an HTML-based user interface for control and/or viewing the device’s status

Universal Plug and Play technology can accommodate various wired (e.g. ethernet, Firewire) or wireless (e.g. WiFi, Bluetooth) connections without requiring any additional/special drivers. Not only that, but the use of common network protocols allows any UPnP-compatible device to participate, regardless of operating system (e.g. Windows, macOS, Android, iOS), programming language, product type (e.g. PC/laptop, mobile device, smart appliances, audio/video entertainment), or manufacturer.

Universal Plug and Play also has an audio/video extension (UPnP AV), commonly incorporated in modern media servers/players, smart televisions, CD/DVD/Blu-ray players, computers/laptops, smartphones/tablets, and more. Similar to the DLNA standard, UPnP AV supports a wide variety of digital audio/video formats and is designed to facilitate content streaming between devices. UPnP AV typically does not require the Universal Plug and Play setting to be enabled on routers.

Universal Plug and Play Scenarios

One common scenario is the network-attached printer. Without Universal Plug and Play, a user would first have to go through the process of connecting and installing the printer on a computer. Then, the user would have to manually configure that printer in order to make it accessible/shared on the local network. Lastly, the user would have to go to each other computer on the network and connect to that printer, just so the printer can be recognized on the network by each of those computers – this can be a very time-consuming process, especially if unexpected issues arise.

With Universal Plug and Play, establishing communication between printers and other network devices is easy and convenient. All you have to do is plug a UPnP-compatible printer into an open ethernet port on the router, and Universal Plug and Play takes care of the rest. Other common UPnP scenarios are:

It’s expected that manufacturers will continue creating consumer devices designed to leverage Universal Plug and Play in order to support features. The trend has steadily expanded to encompass popular smart home product categories:

Security Risks of UPnP

Despite all the benefits offered by Universal Plug and Play, the technology still carries some security risks. The issue is that Universal Plug and Play does not authenticate, assuming that everything connected within a network is trusted and friendly. This means that if a computer has been compromised by malware or a hacker exploiting security bugs/holes – essentially backdoors that can bypass protective network firewalls – everything else on the network is immediately susceptible.

However, this problem has less to do with Universal Plug and Play (think of it like a tool) and more to do with poor implementation (i.e. improper use of a tool). Many routers (particularly older-generation models) are vulnerable, lacking the proper security and checks to determine if requests made by software/programs or services are good or bad.

If your router supports Universal Plug and Play, there will be an option in the settings (follow the instructions outlined in the product manual) to turn the feature off. While it will take some time and effort, one can re-enable sharing/streaming/control of devices on the same network through manual configuration (sometimes performed by a product’s software) and port forwarding.