Port 427 – SLP

TCP/UDP

Port 427 is the SLP (Service Location Protocol) port for automatic service discovery on local networks. SLP enables printers, file servers, and other devices to announce their presence without manual configuration. SLP has no authentication – exposed instances can be abused for DDoS amplification attacks.

Port Number

427

Protocol

TCP/UDP

Service

Service Location Protocol

Range

IANA Well-Known (0–1023)

Description

Service Location Protocol on port 427 allows devices to advertise services and clients to discover them without prior configuration. SLP uses multicast on local networks for service registration and queries. It was designed for enterprise LANs where devices like printers and scanners need to be found automatically. SLP exposed to the internet is a significant DDoS amplification vector – attackers send small queries to exposed SLP instances which respond with much larger service lists directed at victims. The amplification factor can exceed 2,000x. Over 54,000 SLP instances were found exposed in 2023 vulnerability scans. Block port 427 at your perimeter firewall.

Security risks

1CVE-2023-29552 (CVSS 8.6): SLP reflection/amplification DDoS – amplification factor up to 2,200x (one of the highest ever discovered). Over 54,000 exposed SLP instances found globally. Actively exploited in the wild since April 2023
2Service registration without authentication: any host can register arbitrary services in an SLP directory agent, enabling service impersonation and traffic redirection
3No encryption: SLP communicates in cleartext – service URLs, attributes, and scopes are visible to any network observer
4Legacy protocol on modern systems: SLP often runs inadvertently on VMware ESXi (port 427 enabled by default), IPMI/BMC controllers, and enterprise printers – operators don't realize it's exposed
5Network topology disclosure: SLP service discovery responses reveal internal service names, IP addresses, ports, and service attributes to any querying host

Firewall guidance

Block port 427 (both TCP and UDP) at the internet perimeter unconditionally. For internal use: disable SLP on any device that doesn't actively need it. VMware ESXi: /etc/init.d/slpd stop && esxcli network firewall ruleset set -e false -r CIMSLP. For devices that require SLP (printers in legacy environments), restrict to the local subnet only.

Diagnosis commands

Probe for SLP service agent (should fail if properly blocked)

shell

nmap -sU -p 427 --script=slp-discovery target

Discover all SLP service types on the local network

shell

slptool findsrvtypes

VMware ESXi: check SLP statistics and whether daemon is active

shell

esxcli system slp stats get

Check if anything is listening on SLP port locally

shell

ss -ulnp | grep 427

Usage examples

Port 427 – SLP

shell

slptool findsrvtypes
slptool findsrvs service:printer
nmap -sU -p 427 target

Common services on this port

VMware ESXi (OpenSLP)HP/Epson printersNetApp storageIPMI/BMC controllersNovell/Micro Focus eDirectory

Related ports

427

SLP (this port, TCP and UDP)

5353

mDNS (modern local discovery)

1900

SSDP/UPnP (consumer discovery)

History

SLP (Service Location Protocol) was standardized in RFC 2608 (1999) for automatic service discovery in enterprise networks (printers, file servers, directories). Port 427 was assigned by IANA for both TCP and UDP. It predates mDNS/DNS-SD (2002) and was widely adopted by VMware, HP, and Novell. The protocol was largely forgotten by administrators until CVE-2023-29552 revealed 54,000+ exposed instances being weaponized for DDoS amplification.

FAQ

How do I disable SLP on VMware ESXi?

ESXi 7.0+: esxcli network firewall ruleset set -e false -r CIMSLP && /etc/init.d/slpd stop. ESXi 8.0: SLP is disabled by default. For permanent: add /etc/init.d/slpd stop to /etc/rc.local.d/local.sh. VMware released patches for CVE-2023-29552 – apply ESXi patches if you can't disable SLP. Also block UDP/TCP 427 at the virtual switch level.

Why is SLP amplification so severe compared to other protocols?

SLP amplification reaches 2,200x because: (1) the protocol supports service type queries that return large lists of all registered services, (2) responses include full service URLs with attributes (hundreds of bytes per entry), (3) UDP means no handshake – spoofed source IP gets the response. For comparison: DNS amplification is ~50x, NTP ~500x, Memcached ~51,000x. SLP sits between NTP and Memcached in severity.

Specification

RFC 2608 – Port 427 specification →