Ubuntu broadcasting UPnP messages

I notice this with iftop: # Host name (port/service if enabled) last 2s last 10s last 40s cumulative -------------------------------------------------------------------------------------------- 1 192.168.0.1:41144 => 61B 61B 61B 2.86KB 239.255.255.250:1900 <= 0B 0B 0B 0B where 192.168.0.1 is my server. Seems to me that my server is broadcasting UPnP messages. What process is doing this? How can I find it? **Context** My network setup is this: Internet ... [eth0] my server (acting as a router) [eth1] ... [eth0Asus] Asus wireless router [eth1Asus] ... wireless LAN. I'm testing using iftop -i eth1. sudo systemctl status avahi-daemon ● avahi-daemon.service - Avahi mDNS/DNS-SD Stack Loaded: loaded (/lib/systemd/system/avahi-daemon.service; disabled; vendor preset: enabled) Active: inactive (dead) sudo ufw status numbered Status: active To Action From -- ------ ---- 22 LIMIT IN Anywhere 80 ALLOW IN Anywhere 443 ALLOW IN Anywhere uname -a Linux gigi-desktop 4.13.0-37-generic #42~16.04.1-Ubuntu SMP Wed Mar 7 16:03:28 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 16.04.4 LTS Release: 16.04 Codename: xenial