Internet-Security raven logo internet-security.com

UDP 427

ProtocolUDP
Port427
Labelssvrloc, Server Location

Synopsis

  • UDP port 427 is used by the Service Location Protocol (SLP) for service discovery.
  • VMware ESXi runs OpenSLP (service “slpd”) on UDP/TCP 427 to advertise services; vulnerabilities such as CVE-2020-3992 and CVE-2021-21974 were widely exploited (e.g., ESXiArgs ransomware), leading VMware to advise disabling SLP on affected versions.
  • Novell NetWare/eDirectory and the Novell Client used SLP on UDP 427 to locate directory, file, and print services; SUSE Open Enterprise Server carried this forward.
  • CUPS on Unix/Linux can discover printers via SLP on UDP 427, and many enterprise printers (e.g., HP JetDirect, Ricoh, Xerox) advertise print services using SLP.
  • OpenSLP packages on Linux distributions (e.g., SUSE, Red Hat, Ubuntu) provide daemons and clients that communicate on UDP 427 for local service discovery.

Observed activity

Last 30 days Detailed chart

More information