382
Summary
- // typical exposure
- Internal-only — hp-managed-node is a legacy HP/HPE systems-management agent channel meant to communicate with a trusted management server (381/tcp), not to be reachable from the public internet.
- // common applications
- HP OpenView Performance AgentHPE Operations Agent Traffic on this port is most often legacy HP OpenView or HPE Operations Agent performance-monitoring communication between a managed node and its collector on port 381; no other current software has been reported using this port.
- // analyst note
- an open 382/tcp is a legacy HP/HPE management-agent signature — investigate rather than assume routine traffic; legitimate current use is unlikely.
- // if you see it open
- No CVE or named malware family is documented specifically for 382/tcp. Generic port-directory sites (e.g. AuditMyPC) carry an undated, unsourced 'flagged as a Trojan/virus port' warning that is boilerplate repeated across many ports and is not treated as evidence of a specific threat. As a legacy systems-management agent channel it should be restricted to trusted internal networks rather than exposed to the internet.
About port 382/tcp.
Port 382/tcp carries hp-managed-node, HP's legacy Performance Data Managed Node service from the HP OpenView / HPE Operations Agent performance-monitoring suite; it is a management-plane protocol that should stay internal-only rather than exposed to the public internet.
IANA registers 382 on both TCP and UDP as hp-managed-node, "HP Performance Data Managed Node," with no assignee, no reference RFC, and no registration date recorded in the registry. It is the node-side counterpart to port 381/tcp+udp (hp-collector), the management-server side that pulls performance data from managed nodes.
The underlying software lineage is HP OpenView Performance Agent (later renamed HP/HPE Performance Agent and folded into the HPE Operations Agent, with roots also in the older "MeasureWare"/Glance tooling), a 1990s-2000s enterprise systems-management product for collecting CPU, memory, and disk metrics from monitored hosts. No current, actively maintained software was found using this port; it appears effectively obsolete in modern deployments.
No RFC defines the protocol, and no CVE or named malware family is documented against 382/tcp specifically. Generic port-scanner sites carry an undated, unsourced "flagged as a Trojan port" warning that is boilerplate repeated across many ports and is not treated as evidence of a specific threat here.
- IANA assignment
hp-managed-node— "HP Performance Data Managed Node"; reference (blank — no RFC cited); assignee Unknown; dual-registered 382/tcp + 382/udp [Confirmed] — IANA Service Names and Transport Protocol Port Numbers Registry (cached copy, rows 757-758); cross-checked https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=382- Range class
- well-known (0-1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 382/tcp ≈ 0.000000 (not observed open); 382/udp ≈ 0.000346 (negligible) [Confirmed] — https://raw.githubusercontent.com/nmap/nmap/master/nmap-services
- Related ports
- 381/tcp + 381/udp (hp-collector, the paired management-server side) [Confirmed] — IANA registry
Primary use
legacy HP OpenView / HPE Operations Agent performance-data channel on the managed-node side, paired with 381/tcp (hp-collector) on the management server
Other/unofficial uses
none confirmed; no current, actively maintained software found using this port
Security implications
no CVE or named malware family documented for 382/tcp; generic undated "flagged" warnings on port-directory sites are boilerplate, not a specific documented threat
Typically seen on
legacy HP OpenView / HPE systems-management deployments (largely obsolete today) [Likely]
- Analyst note
- an open 382/tcp is a legacy HP/HPE management-agent signature — investigate rather than assume routine traffic; legitimate current use is unlikely.
About port 382/udp.
Port 382/udp carries hp-managed-node, the client-side agent traffic for HP OpenView / HP Performance Agent monitoring software; it should stay internal-only rather than be exposed to the public internet.
IANA registers the port under the service name hp-managed-node with description "hp performance data managed node." The port is dual-registered — 382/tcp carries the same name — the assignee field is blank, and no RFC is cited as the reference.
The agent runs on a monitored ("managed") host and reports performance metrics to a central management server, paired with the alarm-manager side on 383/tcp and 383/udp (hp-alarm-mgr). HP OpenView, later rebranded HP Performance Agent / HP Operations Agent, is a long-discontinued HP/HPE product family.
No independent, dated sightings of other software using 382/udp were found; sources uniformly tie the port to this legacy HP suite. Because the product is discontinued and unmaintained, secondary sources recommend closing ports in this range rather than leaving them reachable.
- IANA assignment
hp-managed-node— "hp performance data managed node"; reference (blank — no RFC cited); assignee blank; dual-registered 382/tcp + 382/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-758- Range class
- well-known (System Ports, 0–1023) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry
- Prevalence
- no dated scanning-prevalence statistic (e.g. Shodan/Censys count) found for 382/udp in this pass [Unknown]
- Related ports
- 382/tcp (same service name); 383/tcp and 383/udp (
hp-alarm-mgr, the paired alarm-manager side)
Primary use
HP OpenView / HP Performance Agent managed-node agent sending performance data to a central management server; paired with 383/tcp+udp (hp-alarm-mgr)
Other/unofficial uses
none independently confirmed; product family is long discontinued
Security implications
legacy, unmaintained HP OpenView/HPE component; secondary sources recommend closing ports 381-383; the paired port 383 has been linked to arbitrary file-deletion issues in some sources, but no CVE specific to 382/udp itself was found
Typically seen on
legacy HP OpenView / HP Performance Agent managed hosts (largely obsolete); otherwise unexpected and worth investigating [Likely]
- Analyst note
- An open 382/udp is most plausibly a leftover from a discontinued HP OpenView/Performance Agent install; there is no confirmed modern legitimate use, so treat a live response as a candidate for remediation.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| hp-managed-node | UDP | hp performance data managed node | 0.03% |
| hp-managed-node | TCP | hp performance data managed node | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.