381
Summary
- // typical exposure
- Internal-only — hp-collector carries management-server-to-managed-node performance data collection for the discontinued HP OpenView suite, a category of traffic that should never be exposed to the public internet even where a legacy dependency still exists.
- // common applications
- HP OpenView Traffic on this port is most often a legacy HP OpenView performance-data-collector process; HP OpenView has been reported using ports 381-383 for management-server-to-managed-node communication, though the suite is discontinued and current sightings likely reflect stale, unmaintained deployments.
- // analyst note
- An open port 381 in 2026 is most plausibly a stale, unmaintained HP OpenView remnant rather than an actively used service; treat as legacy exposure to be investigated and closed absent a documented dependency.
- // if you see it open
- HP OpenView is discontinued, so an open port 381 today is best treated as a legacy/unmaintained leftover rather than a current production service. Community write-ups (cbtnuggets.com) group 381-383 together and recommend closing them absent a documented legacy dependency; a separate arbitrary-file-deletion concern in the same source is attributed to neighboring port 383, not 381, and is single-sourced/unverified beyond that source.
About port 381/tcp.
Port 381/tcp carries hp-collector, IANA's name for the HP Performance Data Collector service; it should stay internal-only rather than face the public internet, since it belongs to management traffic between a monitoring server and the nodes it monitors.
IANA's registry lists the service name as hp-collector with the description "hp performance data collector," dual-registered on TCP and UDP, with no assignee and a blank Reference column — no RFC or reference document is on file for this port.
The port is tied to HP OpenView, HP's discontinued enterprise network and systems management suite. Management servers used it to pull performance data from managed nodes; secondary sources describe the UDP side as also carrying related monitoring traffic such as SNMP traps and ICMP pings in that role.
Because HP OpenView is long discontinued, a live listener on 381 today is best read as a legacy leftover from an old deployment rather than an actively-maintained service, and general guidance is to close it along with its neighbors (382, 383) unless a specific legacy dependency requires it.
- IANA assignment
hp-collector— "hp performance data collector"; reference blank (no RFC on file); assignee blank; dual-registered 381/tcp + 381/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- not available from this research pass (no nmap-services or similar frequency data retrieved) [Unknown]
- Related ports
- 382/tcp (hp-managed-node), 383/tcp (hp-alarm-mgr) — the HP OpenView port cluster
Primary use
HP Performance Data Collector, a component of the legacy HP OpenView network/systems management suite, used by management servers to collect performance data from managed nodes
Other/unofficial uses
none found with credible sourcing beyond HP OpenView in this pass [Unknown]
Security implications
legacy/discontinued-software exposure; general guidance to close 381-383 on modern systems; a neighboring-port (383) arbitrary-file-deletion claim is single-sourced and unverified beyond that source
Typically seen on
legacy HP OpenView management servers and managed nodes [Likely]
- Analyst note
- An open port 381 in 2026 is most plausibly a stale, unmaintained HP OpenView remnant rather than an actively used service; treat as legacy exposure to be investigated and closed absent a documented dependency.
About port 381/udp.
Port 381/udp carries hp-collector, part of the discontinued HP OpenView network-management suite's data-collection channel; it belongs on an internal management network, not the public internet, and a live response today is best treated as a legacy artifact or misconfiguration rather than a normal service.
IANA's Service Name and Port Number Registry lists hp-collector on both 381/tcp and 381/udp with the description "hp performance data collector." The reference/RFC field is blank in the registry, and no assignee, contact, or registration-date metadata is populated — that absence is preserved here rather than guessed at.
Secondary sources tie the port to HP OpenView, whose Performance Data Collector polled or received metrics from managed nodes as part of a contiguous port block (381–383) reserved for the suite's collector, managed-node, and alarm-manager components. UDP traffic in this range is also described as covering SNMP trap reception and ICMP-based discovery/monitoring, though this attribution comes from aggregator sites rather than a primary HP document.
HP OpenView was later rebranded as HP Network Node Manager and HP Operations, and after HP's software divestiture the lineage passed to Micro Focus and then OpenText. No modern software has been reported using 381/udp in the sources reviewed for this entry.
- IANA assignment
hp-collector— "hp performance data collector"; reference field blank; dual-registered 381/tcp + 381/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 381/udp ≈ 0.000577 — very low (roughly 6 in 10,000 scanned hosts in the nmap-services sample) [Likely] — nmap-services dataset; no additional scan-telemetry figure specific to 381/udp was located [Unknown]
- Related ports
- 382/tcp+udp (
hp-managed-node), 383/tcp+udp (hp-alarm-mgr) — same HP OpenView port block [Likely] — CBT Nuggets
Primary use
HP OpenView Performance Data Collector, polling/receiving metrics from managed nodes over an internal management network
Other/unofficial uses
SNMP trap reception and ICMP-based discovery/monitoring within the same HP OpenView port block (381–383) per secondary sources
Security implications
essentially never legitimately open on a modern network given HP OpenView's discontinuation; no CVE or security bulletin found for this port specifically
Typically seen on
legacy HP OpenView (or successor Micro Focus/OpenText) management hosts; otherwise a legacy/misconfiguration signal [Likely]
- Analyst note
- An open 381/udp is most plausibly a stale HP OpenView deployment; corroborate with the adjacent 382/383 ports before treating it as noteworthy.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| hp-collector | UDP | hp performance data collector | 0.06% |
| hp-collector | TCP | hp performance data collector | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.