Port 427 (SLP (Service Location Protocol))

Service Location Protocol, used by VMware ESXi (OpenSLP) and some printers.

Well-known (system) port, 0-1023 TCPUDP Network infrastructure Do not expose to the internet

What port 427 is used for

Service Location Protocol, used by VMware ESXi (OpenSLP) and some printers.

Security: should port 427 be open?

Do not expose to the internet. Exposed SLP was the entry point for ESXiArgs ransomware (CVE-2021-21974) and can amplify DDoS traffic over 2,000x (CVE-2023-29552). Disable it where not needed.

IANA assignment

Service nameProtoDescriptionAssigneeReference

svrloc TCP Server Location Veizades -

svrloc UDP Server Location Veizades -

Check what is listening on port 427

Linux: is anything listening on TCP 427?

sudo ss -tlnp 'sport = :427'

Linux: UDP 427

sudo ss -ulnp 'sport = :427'

Linux / macOS: which process owns the port

sudo lsof -nP -i :427

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':427 '

Windows (Command Prompt)

netstat -ano | findstr :427

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 427 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 427

From Windows

Test-NetConnection HOST -Port 427

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 427

Block port 427 in the firewall

ufw

sudo ufw deny 427/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 427 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 427 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 427' -Direction Inbound -Protocol TCP -LocalPort 427 -Action Block

ufw

sudo ufw deny 427/udp