427

Port 427/tcp is registered with IANA as svrloc with the description "Server Location," assignee/contact Veizades (J. Veizades, an RFC 2608 co-author), blank registration and modification dates, and a blank reference field (dual-registered on TCP and UDP, with SLP also using multicast address 239.255.255.253). SLP is a service-discovery protocol that lets hosts find services such as printers, file servers, and VMware hosts on a LAN with little or no static configuration. It is defined in RFC 2165 (SLPv1, June 1997) and RFC 2608 (SLPv2, June 1999), using three roles — User Agents, Service Agents, and optional Directory Agents — over UDP and TCP 427, with large responses falling back to TCP and discovery using multicast. It is largely deprecated but persists in VMware ESXi (OpenSLP) and network printers, and crucially it requires no authentication, which is why it was never meant to face the internet. The IANA reference field is blank. The security headline is CVE-2023-29552, disclosed 25 April 2023 by Bitsight and Curesec: an SLP reflection/amplification DDoS flaw in which an unauthenticated attacker registers arbitrary services to inflate responses, reaching an amplification factor of more than 2,200x (a ~29-byte request yielding a ~65,000-byte response); Bitsight found over 54,000 SLP-speaking instances across more than 2,000 organizations and 670+ product types, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on 8 November 2023, with observed attacks reported up to ~105 Gbps. Port 427 also has a heavy VMware ESXi OpenSLP vulnerability history: CVE-2021-21974 (a heap-overflow RCE, VMSA-2021-0002, Feb 2021) was exploited in the February 2023 ESXiArgs ransomware campaign that encrypted thousands of internet-exposed ESXi hosts, and earlier flaws include CVE-2020-3992 (use-after-free RCE) and CVE-2019-5544 (heap overflow); VMware has disabled or deprecated SLP by default in ESXi since 7.0 U2c / 8.0 GA. For an analyst, an open 427 is an SLP service — most often VMware ESXi or a printer — and should be treated as both a DDoS-amplification liability and, if ESXi, a ransomware exposure, remediated by disabling SLP or blocking TCP and UDP 427 at the perimeter.

IANA assignment

svrloc — "Server Location"; reference (blank — no RFC cited in IANA registry); assignee Veizades (RFC 2608 co-author); dual-registered 427/tcp + 427/udp; SLP multicast 239.255.255.253 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

relatively common for a legacy service; nmap-services open-frequency ~0.005382 (de-facto) [Well-established] — nmap-services file

Related ports

SLP multicast 239.255.255.253

Primary use

LAN service discovery (SLP, RFC 2608); largely deprecated

Other/unofficial uses

VMware ESXi (OpenSLP), network printers [Well-established]

Security implications

no authentication; CVE-2023-29552 reflection/amplification DDoS (~2,200x, disclosed 25 Apr 2023 by Bitsight/Curesec, >54,000 instances/2,000+ orgs, CISA KEV 8 Nov 2023, attacks up to ~105 Gbps); ESXi OpenSLP history — CVE-2021-21974 (ESXiArgs ransomware Feb 2023), CVE-2020-3992, CVE-2019-5544; never internet-expose

Typically seen on

VMware ESXi hosts, network printers, older Mac/Novell environments

Analyst note

An open 427 is an SLP service — most often VMware ESXi or a printer; treat as a DDoS-amplification liability and (if ESXi) a ransomware exposure. Disable SLP or block TCP+UDP 427.

Port 427/udp carries the Service Location Protocol (SLP), a zero-configuration LAN service-discovery protocol; it should never be exposed to the public internet because it has no built-in authentication and is a documented reflection/amplification DDoS vector. Nmap-services scan data puts SLP's UDP open-frequency at 0.01827 — roughly 18 openings per thousand hosts scanned — making it one of the more commonly found open services in this measurement, which is exactly the real-world exposure that made CVE-2023-29552 a practical amplification risk rather than a theoretical one.

IANA registers 427 as svrloc — "Server Location" — with assignee [Veizades], dual-registered on both 427/tcp and 427/udp, and a blank Reference column in the registry itself. The protocol SLP itself is defined in RFC 2608 (June 1999), which several independent secondary sources cite even though the registry's own Reference field is empty.

SLP works by having User Agents query for services, Service Agents advertise them, and an optional Directory Agent centralize registrations on a LAN — the same kind of role mDNS/Bonjour plays on Apple networks. Discovery traffic is mostly UDP, with TCP available for replies too large for a single datagram.

In practice the most commonly cited real-world source of 427 traffic is VMware ESXi/vSphere, which uses SLP for management and service discovery; openSLP is the reference open-source implementation. Community and vendor threads also report SLP on network printers, NAS appliances, and ServiceNow ITOM Discovery probing storage arrays on this port.

IANA assignment

svrloc — "Server Location"; reference (blank in registry); assignee [Veizades]; dual-registered 427/tcp + 427/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry lines 847-848

Range class

well-known (0–1023)

Prevalence

0.01827 for UDP — nmap-services open-frequency figure, roughly 18 openings per thousand hosts scanned; the paired 427/tcp figure is 0.005382 [Confirmed] — this site's own tooling

Related ports

other service-discovery mechanisms (mDNS 5353/udp, SSDP 1900/udp); the /port/ hub

Primary use

Service Location Protocol (SLP), RFC 2608 — zero-configuration LAN service discovery via User Agents, Service Agents, and optional Directory Agents

Other/unofficial uses

VMware ESXi/vSphere management and service discovery; openSLP implementations; network printers and NAS devices; ServiceNow ITOM Discovery storage-array probing [Likely] — https://community.broadcom.com/vmware-cloud-foundation/discussion/do-we-need-the-slp-service-on-port-427, https://www.servicenow.com/community/itom-forum/storage-discovery-when-port-427-is-refused/m-p/890258

Security implications

no built-in authentication/encryption; CVE-2023-29552 reflection/amplification DDoS (up to ~2,200x); ESXi-related CVE-2021-21974, CVE-2020-3992, CVE-2019-5544; Shadowserver flags internet-exposed SLP as HIGH severity [Confirmed] — https://www.shadowserver.org/what-we-do/network-reporting/accessible-slp-service-report/, https://www.bleepingcomputer.com/news/security/new-slp-bug-can-lead-to-massive-2-200x-ddos-amplification-attacks/

Typically seen on

VMware ESXi/vSphere hosts; NAS/printer appliances on internal LANs; should not appear on internet-facing hosts

Analyst note

An internet-reachable port 427 is a red flag — SLP is meant for trusted LAN discovery only, and exposure has been directly weaponized for DDoS amplification.