UPnP control point M-Search requests are sent TO multicast address 239.255.255.250:1900, and the responses from devices responding to these requests is sent in UDP UNICAST back to the control point's sending port.

Multicast address 239.255.255.250:1900 on the control point is used for listening for UPnP NOTIFY multicasts from devices.

SC is attempting to use 239.255.255.250:1900 for both SENDING M-search requests and listening for NOTIFY's. As this socket is configured as a multicast listener it does not receive any of the M-Search responses from devices.

The M-Search request should be sent using some different port, which then listens for UNICAST UDP responses from devices.

The symptoms of this defect are that UPnP devices may take considerable time to be discovered as the M-Search responses are not received, so SC only becomes aware of them when they send a NOTIFY message (which typically occurs every 30 mins)

See http://www.upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf sect. 1.3.2 for details