# WHATPORT(5405)

## NAME

port 5405 — Corosync cluster messaging (IANA: netsupport) — Almost always Corosync — the heartbeat and membership traffic of a Pacemaker or Proxmox cluster.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

IANA has 5405 registered as netsupport, but what you actually meet on this number is Corosync: its default mcastport is 5405, and the totem protocol receives on 5405 and sends on 5404, over UDP. That traffic carries cluster membership and the messages that decide which node runs which resource, so it shows up on every Pacemaker, Proxmox VE, and RHEL High Availability node. TCP 5405 is registered but idle in these deployments.

## EXPOSURE

**Do not expose.** Anyone who can inject or block totem traffic can split the cluster or trigger fencing — Corosync belongs on a dedicated private cluster network, with its crypto_hash/crypto_cipher key set.

## CHECK

```sh
sudo tcpdump -ni any udp port 5405
```

## SEE ALSO

- docs — [corosync.conf(5) — totem mcastport default](https://manpages.debian.org/unstable/corosync/corosync.conf.5.en.html) (manpages.debian.org)
- source — [corosync/corosync](https://github.com/corosync/corosync) (github.com)
- iana — [IANA port registry — 5405 (netsupport)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5405) (iana.org)

---

HTML: <https://whatport.net/5405/> · JSON: <https://whatport.net/5405.json> · full dataset: <https://whatport.net/ports.json>