Skip to content
ProtocolPorts

Port reference

Port 427 (UDP/TCP) – SLP

Service Location Protocol — lets devices discover services on a LAN without manual configuration.

udptcpWell-known

Quick facts

Transport
udp, tcp
Category
Well-known
Risk level
Critical

Actively exploited and high-impact — keep it off the public internet.

Default state

Enabled by default on many VMware ESXi builds, printers, and storage/SAN appliances. Should never be reachable from the internet.

What is port 427 used for?

Port 427 runs the Service Location Protocol (SLP), which lets devices on a network find services automatically without manual setup. It is commonly built into VMware ESXi hosts, network printers from brands like HP and Brother, and SAN/NAS storage appliances, helping clients discover them on the local network. SLP is designed for use inside a LAN, not across the internet.

When would you open it?

You would only allow port 427 if you run an appliance or virtualization host that relies on SLP for service discovery on your local network. In that case, keep it limited to your internal management network or VLAN. There is almost never a reason to forward it through a router to the internet.

Is it safe to open?

Exposing SLP publicly is risky because it can leak service details and be abused for traffic amplification, so keep it on a trusted internal network only. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :427
nmap -p 427 <target>
Windows
netstat -ano | findstr :427
Test-NetConnection <host> -Port 427
macOS
lsof -i :427
nmap -p 427 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 427 to your device's local IP, internal port 427, protocol TCP/UDP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 427/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=427/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 427 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 427" -Direction Inbound -Protocol TCP -LocalPort 427 -Action Allow

Security & risks

Common attacks

  • Massive UDP amplification DDoS (CVE-2023-29552)
  • Service and host enumeration / information disclosure

CVE-2023-29552

Hardening

  • Disable SLP wherever it isn't required (e.g. ESXi slpd)
  • Block UDP/TCP 427 at the internet edge
  • Restrict SLP to trusted management VLANs only
  • Patch appliances that expose SLP per vendor advisories

How to block this port

Linux (ufw)
sudo ufw deny 427/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=427/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 427 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 427" -Direction Inbound -Protocol TCP -LocalPort 427 -Action Block

nmap snippet

nmap -sU -p427 --script slp-discovery <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 53Port 1900Port 5353Port 137

Frequently asked questions

What uses port 427?
Port 427 is the Service Location Protocol (SLP), used for service discovery by VMware ESXi, network printers, and storage appliances. It is rarely needed on the public internet.
How bad is the SLP amplification flaw?
CVE-2023-29552 lets attackers register fake services so a tiny query yields a huge reply, producing amplification factors above 2000x — among the largest ever recorded.

Related guides