7

I scanned my machine using Nmap and found an open port (5431) is used by the "park-agent" service.

What is the "part-agent" service used for?

Gareth
  • 18,809
  • 2
    A service may use any port number to recieve packets. By convention the IANA registers and publishes port numbers. However a rogue process could use any port number without being the service assigned to use the port. – this.josh Sep 01 '11 at 06:40

4 Answers4

5

By the time you've made this question u probably already know the answer... But here goes the answer: This port is related to uPNP services. I've made a port scanning on my home router and found this "park-agent" port opened in it. After some research on the internet I read some people talking about uPNP. Then I decided to disable the uPNP service on my router and bingo! The port has been closed! I just don't know how exactly uPNP works but i read that it allows devices that "talk" uPNP to search and find each other in your network for communications purposes (i.e. media sharing, and other stuff which idk how it's being shared). So it looks to be insecure if enabled on your gateway or router since you don't want to share through internet your media or anything else you don't know how exactly is being shared to the world. ;)

Marcelo
  • 51
4

If its your own system, you could probably run netstat -b (on windows) or netstat -p (on linux) on the system its running on to identify the process- netstat tends to use behaviour to guess what sort of software is running, and what OS, and that description sounds rather generic.

Journeyman Geek
  • 129,178
3

The description "Park Agent" will likely just come from the nmap services file, it doens't necessarily mean that that's what's running on the system.

What sort of host is it that you saw it running on? One suggestion I've seen for that port is UPnP

Rory McCune
  • 571
  • 1
    Can you complete your answer please it's not really an answer at all. How do you figure it comes from nmap services file? If a port is open on the host machine and the scan is run locally, what would nmap need that service for? – Magpie May 12 '14 at 19:23
  • for the first part of your comment I'm afraid to say my answer is complete, nmap looks up a file called nmap-services and that's the text it shows, which is what OP saw, that's how Nmap works. As to the second part of your comment I'm afraid I don't really see what you mean, so I can't really comment – Rory McCune May 12 '14 at 19:33
  • Did you read the question at all? It asked: "What is the "part-agent" service used for?" You did not answer the question. – Magpie May 12 '14 at 21:46
  • 1
    I did read the question although it appears you may not have. The questioner said that they used nmap to scan a host and that it reported port 5431/TCP as open and that nmap said that this is for the "park-agent" service. The reason that nmap said that port 5431/TCP is for the park-agent service, is that it does a lookup on the file nmap-services and matches the port to the relevant line. As my answer says that's why nmap says that it's park-agent. In reality it may well not be that, but nmap reports that based on the file. if you've got a better answer feel free to post it :) – Rory McCune May 13 '14 at 08:52
0

I know this is an old question, but I had the exact same question myself just now. And the answers here are terrible.

According to this answer on Quora, the park-agent service is rarely used but uPnP is a current service that frequently uses port 5431 is uPnP - Universal Plug And Play.

According to the uPnP wiki entry, it is a protocol that helps devices find each other.

According to an article by Varonis uPnP was used in the massive Mirai botnet attack.

It is likely users will want to disable it from their home routers, but watch for network problems like being unable to connect to various devices around the house. Turn it back on if something breaks.

Rick Henderson
  • 101
  • 2