Port 902 (VMware ESXi / authd)

VMware authentication daemon and console traffic between vCenter, clients and ESXi hosts.

Well-known (system) port, 0-1023 TCPUDP Remote access Do not expose to the internet

What port 902 is used for

VMware authentication daemon and console traffic between vCenter, clients and ESXi hosts.

Security: should port 902 be open?

Do not expose to the internet. Keep ESXi management on an isolated network; ESXiArgs ransomware (2023) mass-exploited internet-exposed ESXi hosts (OpenSLP, port 427).

IANA assignment

Service nameProtoDescriptionAssigneeReference

ideafarm-door TCP self documenting Telnet Door - -

ideafarm-door UDP self documenting Door: send 0x00 for info - -

Check what is listening on port 902

Linux: is anything listening on TCP 902?

sudo ss -tlnp 'sport = :902'

Linux: UDP 902

sudo ss -ulnp 'sport = :902'

Linux / macOS: which process owns the port

sudo lsof -nP -i :902

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':902 '

Windows (Command Prompt)

netstat -ano | findstr :902

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 902 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 902

From Windows

Test-NetConnection HOST -Port 902

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 902

Block port 902 in the firewall

ufw

sudo ufw deny 902/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 902 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 902 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 902' -Direction Inbound -Protocol TCP -LocalPort 902 -Action Block

ufw

sudo ufw deny 902/udp