I have logged in into my router using the web interface. I was checking UPnP forwarding (which is enabled by default), and found out that whatsapp is initiating a UPnP request on port 65072. Is there a way that I can understand, why and how whatsapp is using UPnP? Is it something normal ?
WhatsApp uses uPnP for NAT traversal and external IP Address discovery. It only happens when you initialise WhatsApp call.
Some of the NAT traversal techniques are:
- NAT-PMP (obsolete but still used by some of the BitTorrent clients)
- PCP (successor of NAT-PMP)
- uPnP (also used by BitTorrent client)
Through uPnP WhatsApp establishes peer-to-peer communication to initiate VoIP. uPnP is also a dynamic port forwarding technique so it is active as long as the P2P communication is running. If you disable uPnP in your router, then WhatsApp switches to STUN.
It used to be only STUN/TURN in older versions and they recently added uPnP support. I think it is because they want to reduce the call set up time. STUN has its own complications like it doesn't work with Symmetric NAT and first client has to discover if it is sitting behind a Symmetric NAT, then only it switches to TURN using ICE which further increases call set up time.
Whereas in uPnP, client only has to talk to the router to initialise the session and keep it active. This greatly reduces the round trips and call set up time.
WhatsApp itself is owned by Facebook and is an end to end encrypted communication service. As a communication protocol, it has many features and functions which people use to communicate including voice and chat. On its own, WhatsApp is not a bad service and is used by millions of users around the globe.
If you are not familiar with the application and are sure none of the users within your home are leveraging it, I would recommend identifying the internal source and removing it. WhatsApp is a communication service which could be used to send bot commands or retrieve data from a potential zombie within your network.