SLP (Service Location Protocol)

Description

SLP (RFC 2608) lets user agents discover services without configuration: agents multicast or unicast service requests to 427 and service agents reply with URLs, optionally through a directory agent that aggregates registrations. It shipped enabled by default on VMware ESXi, on network printers, on NetApp's SMI-S provider and on SUSE systems, which is why it still appears on scans of datacenter networks. Two things made it notorious: CVE-2021-21974, the ESXi OpenSLP heap overflow that the ESXiArgs ransomware campaign exploited at scale, and CVE-2023-29552, which lets an attacker register services and then reflect spoofed UDP at up to roughly 2,200x amplification.

Exposed to the internet?

Check it yourself

$ nmap -sU -p 427 --script srvloc TARGET

See also

• spec RFC 2608 — Service Location Protocol, Version 2rfc-editor.org
• docs CVE-2023-29552 — SLP reflective denial-of-service amplificationcve.org
• docs CVE-2021-21974 — ESXi OpenSLP heap overflow (the ESXiArgs vector)cve.org
• source openslp-org/openslp — the reference SLP implementationgithub.com
• iana IANA Service Name and Transport Protocol Port Number Registry — 427iana.org