Port 2381: HP Systems Management Homepage — The server's dashboard that shouldn't be public

Port 2381 sits in the registered port range (1024–49151) — the middle tier of the port numbering system, where IANA registers services by application. But despite occupying this space, port 2381 carries no official IANA assignment. What it carries instead is something that became standard across HP server infrastructure for decades.

What Actually Runs Here

HP ProLiant servers ship with a component called HP Systems Management Homepage (SMH), formerly known as Compaq Insight Manager. It's a web-based dashboard that gives administrators a view into server hardware: CPU temperatures, fan speeds, disk health, memory status, firmware versions — the vital signs of the machine.

The interface runs on two ports by design:

• Port 2301 — HTTP, which immediately redirects to...
• Port 2381 — HTTPS, where the actual management interface lives

This 2301 → 2381 pairing became so consistent across HP hardware that network scanners treat it as a reliable fingerprint. Find port 2381 open, and there's a reasonable chance you've found an HP ProLiant.

The Security History

HP shipped SMH enabled by default on production servers, which meant port 2381 ended up exposed in environments where nobody had consciously chosen to run it. The CVE list that followed is substantial:

• Anonymous authentication bypass — certain versions allowed access without credentials¹
• Directory traversal — attackers could read files outside the web root using ../ sequences (CVE-2007-4044)
• POODLE vulnerability — SSLv3 downgrade attacks on the HTTPS interface
• Session renegotiation flaws — man-in-the-middle insertion via CVE-2009-3555

Penetration testers learned to check for 2381 as a matter of routine. The HackTricks guide dedicated a page to it.² Metasploit has a module for HP System Management anonymous access code execution.³

The lesson isn't that HP wrote bad software — it's that management interfaces exposed to networks without authentication requirements are dangerous regardless of what runs on them.

Checking What's Listening on This Port

If you see port 2381 active on a system you manage:

On Linux:

ss -tlnp | grep 2381
# or
lsof -i :2381

On Windows:

netstat -ano | findstr :2381

From another machine:

nmap -sV -p 2381 <target-ip>

If you find HP SMH running and you're not actively using it, consider disabling it. If you are using it, ensure it's firewalled to your management network only — never Internet-facing.

Why Unassigned Ports Like This Exist

The registered port range covers 1024 through 49151. IANA assigns ports in this range to specific services through a formal registration process, but the range has roughly 48,000 slots and the Internet has more applications than that. Plenty of software — especially enterprise tools — picks a port and ships with it before or without seeking official registration.

Port 2381 is a good example. HP chose it, deployed it across millions of servers, and it became de facto standard for HP management traffic. The port became known through use, not through registration. This is common in the registered range: the official assignment and the actual use are often different things.

Related Ports

• 2301 — HTTP companion that redirects to 2381
• 22 — SSH, the secure alternative for remote server management
• 443 — Standard HTTPS; some SMH versions can be reconfigured to use this instead
• 623 — IPMI/BMC, another hardware management protocol on HP and other servers