I ran Wireshark on my laptop to capture the packets for only a few seconds while I had bunch of application open but inactive. I turned on address resolver and while some apps run on AWS send packets in the background via TCP makes a lot of sense, my Philip Hue System talking to my Laptop over SSDP every second wasn't immediate clear. Three of my four Hue light bulbs was on at the time of the analysis, what happens if they were off?

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/45bacd49-add9-40ad-8a34-5e9e67765679/Screen_Shot_2019-10-24_at_1.32.33_PM.png

With all the devices connect to my network, while both my Mac and my iPad is able to control the Hue system, I exclusively use my iPhone to control, sometimes via HomeKit, some times through the Hue app.

So I went on a quest to investigate what is SSDP and when/how/why do my lightbulbs talk to my laptop.

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/e2ab2b39-8bae-48b4-930e-3b96ae4e5988/Screen_Shot_2019-10-24_at_1.58.20_PM.png

All frames has the same src and dst port numbers:

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/c1684e06-5bad-4460-b9e6-9aed022eacd5/f16.png

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/7205b68a-de10-4dd7-a02b-1c98f846df8b/f17.png

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/fdb5e7cc-c396-49a7-bd65-48bbe3a7ab95/f18.png

It is IPV4

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/ebf3cef3-6140-41de-8df2-5b60d4198e08/useIPV4.png

Uses UDP underneath:

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/ebde6c2c-f45e-4855-979b-562ee37142f3/useUDP.png

From the packets, I got that there is UDP connections under SSDPs. The source port and destination port doesn't change between packets. From looking up SSDP, the patterns fit the profile. For example, use UDP port number 1900.

"SSDP is a text-based protocol based on HTTPU. It uses UDP as the underlying transport protocol. Services are announced by the hosting system with multicast addressing to a specifically designated IP multicast address at UDP port number 1900. In IPv4, the multicast address is 239.255.255.250[4] and SSDP over IPv6 uses the address set ff0X::c for all scope ranges indicated by X.[5]"

Philip Hue Disappeared when I ran Wireshark for the second time. I happen to have caught Hue talking to my laptop on my first run. I ran a few more times, and started controlling hue with my iPhone. The first time I controlled Hue on my iPhone, it send out a broadcast of "who has xxx.xxx.xxx.x address" which I failed to screenshot. As I continued to control Hue from my iPhone, the connection stopped showing up on my laptop.