# WHATPORT(427)

## NAME

port 427 — SLP (Service Location Protocol) — Service Location Protocol — VMware ESXi, printers, and SAN gear advertising what they offer, and a serious DDoS reflector.

Protocol: TCP/UDP  
IANA: svrloc

## DESCRIPTION

SLP (RFC 2608) lets user agents discover services without configuration: agents multicast or unicast service requests to 427 and service agents reply with URLs, optionally through a directory agent that aggregates registrations. It shipped enabled by default on VMware ESXi, on network printers, on NetApp's SMI-S provider and on SUSE systems, which is why it still appears on scans of datacenter networks. Two things made it notorious: CVE-2021-21974, the ESXi OpenSLP heap overflow that the ESXiArgs ransomware campaign exploited at scale, and CVE-2023-29552, which lets an attacker register services and then reflect spoofed UDP at up to roughly 2,200x amplification.

## EXPOSURE

**Do not expose.** CISA added CVE-2023-29552 to its Known Exploited Vulnerabilities catalog and its required action is to disable SLP or block 427/UDP on anything reachable from an untrusted network.

## CHECK

```sh
nmap -sU -p 427 --script srvloc TARGET
```

## SEE ALSO

- spec — [RFC 2608 — Service Location Protocol, Version 2](https://www.rfc-editor.org/rfc/rfc2608.html) (rfc-editor.org)
- docs — [CVE-2023-29552 — SLP reflective denial-of-service amplification](https://www.cve.org/CVERecord?id=CVE-2023-29552) (cve.org)
- docs — [CVE-2021-21974 — ESXi OpenSLP heap overflow (the ESXiArgs vector)](https://www.cve.org/CVERecord?id=CVE-2021-21974) (cve.org)
- source — [openslp-org/openslp — the reference SLP implementation](https://github.com/openslp-org/openslp) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 427](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=427) (iana.org)

---

HTML: <https://whatport.net/427/> · JSON: <https://whatport.net/427.json> · full dataset: <https://whatport.net/ports.json>