Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I scanned my machine using Nmap and found an open port (5431) is used by the "park-agent" service.

What is the "part-agent" service used for?

share|improve this question

migrated from Sep 1 '11 at 6:56

This question came from our site for information security professionals.

A service may use any port number to recieve packets. By convention the IANA registers and publishes port numbers. However a rogue process could use any port number without being the service assigned to use the port. – this.josh Sep 1 '11 at 6:40

The description "Park Agent" will likely just come from the nmap services file, it doens't necessarily mean that that's what's running on the system.

What sort of host is it that you saw it running on? One suggestion I've seen for that port is UPnP

share|improve this answer
Can you complete your answer please it's not really an answer at all. How do you figure it comes from nmap services file? If a port is open on the host machine and the scan is run locally, what would nmap need that service for? – Magpie May 12 '14 at 19:23
for the first part of your comment I'm afraid to say my answer is complete, nmap looks up a file called nmap-services and that's the text it shows, which is what OP saw, that's how Nmap works. As to the second part of your comment I'm afraid I don't really see what you mean, so I can't really comment – Rоry McCune May 12 '14 at 19:33
Did you read the question at all? It asked: "What is the "part-agent" service used for?" You did not answer the question. – Magpie May 12 '14 at 21:46
I did read the question although it appears you may not have. The questioner said that they used nmap to scan a host and that it reported port 5431/TCP as open and that nmap said that this is for the "park-agent" service. The reason that nmap said that port 5431/TCP is for the park-agent service, is that it does a lookup on the file nmap-services and matches the port to the relevant line. As my answer says that's why nmap says that it's park-agent. In reality it may well not be that, but nmap reports that based on the file. if you've got a better answer feel free to post it :) – Rоry McCune May 13 '14 at 8:52

If its your own system, you could probably run netstat -b (on windows) or netstat -p (on linux) on the system its running on to identify the process- netstat tends to use behaviour to guess what sort of software is running, and what OS, and that description sounds rather generic.

share|improve this answer

By the time you've made this question u probably already know the answer... But here goes the answer: This port is related to uPNP services. I've made a port scanning on my home router and found this "park-agent" port opened in it. After some research on the internet I read some people talking about uPNP. Then I decided to disable the uPNP service on my router and bingo! The port has been closed! I just don't know how exactly uPNP works but i read that it allows devices that "talk" uPNP to search and find each other in your network for communications purposes (i.e. media sharing, and other stuff which idk how it's being shared). So it looks to be insecure if enabled on your gateway or router since you don't want to share through internet your media or anything else you don't know how exactly is being shared to the world. ;)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.