Almost always Corosync — the heartbeat and membership traffic of a Pacemaker or Proxmox cluster.
IANA has 5405 registered as netsupport, but what you actually meet on this number is Corosync: its default mcastport is 5405, and the totem protocol receives on 5405 and sends on 5404, over UDP. That traffic carries cluster membership and the messages that decide which node runs which resource, so it shows up on every Pacemaker, Proxmox VE, and RHEL High Availability node. TCP 5405 is registered but idle in these deployments.
Do not expose
Anyone who can inject or block totem traffic can split the cluster or trigger fencing — Corosync belongs on a dedicated private cluster network, with its crypto_hash/crypto_cipher key set.
$ sudo tcpdump -ni any udp port 5405Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.