WHATPORT(5666) whatport.net WHATPORT(5666)
5666

NRPE (Nagios Remote Plugin Executor)

A monitoring agent — the Nagios server connects here to run checks on this host.

TCP IANA registry

Description

NRPE runs on a monitored machine and executes local plugins (disk, load, process checks) on request from a Nagios, Icinga, or Naemon server, returning the status text and exit code. IANA registered 5666 to Nagios Enterprises in 2017. Access control is a plaintext allowed_hosts list plus, in NRPE 3 and later, TLS — but the default anonymous-DH mode encrypts without authenticating either side. Enabling dont_blame_nrpe so callers may pass arguments has repeatedly turned into remote command execution.

Exposed to the internet?

Do not expose

It exists to run commands on the host for whoever asks — restrict it to the monitoring server's address, keep command arguments disabled, and never publish it.

Check it yourself

$ check_nrpe -H TARGET

See also

Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.

Get Beige Box →

also available as JSON · Markdown

Corrections or a missing port? Reply @rimrocksystems.