Port 1847: SLP Notification — The Service Announcement That Lost to Bonjour

What Port 1847 Is

Port 1847 is the IANA-registered port for SLP Notification (slp-notify), an extension to the Service Location Protocol (SLP). It runs on both TCP and UDP.

SLP was a protocol for automatic service discovery on local networks — a way for devices to find printers, file servers, and other services without manual configuration. Port 1847 handled a specific piece of that: the moment a service appeared or disappeared, it would announce itself here rather than waiting for clients to come asking.

The Problem It Was Solving

The original SLP design was demand-driven. User agents asked the network "what's available?" — and that was fine until someone needed a GUI that showed live service availability. To keep that list current, clients had to poll constantly: ask, wait, ask again. At scale, this wastes bandwidth and processor time on questions that mostly return the same answer.

The solution in RFC 3082 was notification: when a service registers or deregisters, it multicasts a message to IPv4 group 239.255.255.253 on port 1847. Clients interested in updates join that multicast group and listen. No polling. Services speak when they have something to say.

Why Not the Standard SLP Port?

SLP's main port is 427. That port sits in the well-known range (0–1023), which on Unix-derived systems requires root privileges to bind. Using a registered port for notifications meant notification listeners could run without elevated privileges — a practical concession to operating system realities.

What Happened to It

RFC 3082 was published in March 2001 by James Kempf and Jason Goldschmidt at Sun Microsystems. It was marked Experimental from the start, and eventually designated Legacy — meaning the IETF does not formally endorse it.

SLP itself never achieved wide adoption. Apple introduced Bonjour (based on mDNS and DNS-SD) in 2002, which solved the same service-discovery problem with a simpler, more elegant design. Bonjour won. SLP, and with it port 1847, became a footnote in the history of how networks learned to find themselves.

Is Anything Still Using This Port?

In practice: rarely. Some enterprise systems — particularly older Sun/Oracle infrastructure and certain HP and IBM products that implemented SLP — may still generate traffic on port 1847 in legacy environments. If you're seeing activity here on a modern network, it's worth investigating what's listening.

How to Check What's Using This Port

# See if anything is listening on port 1847
sudo ss -tlunp | grep 1847

# Or with netstat (older systems)
sudo netstat -tlunp | grep 1847

# Check for any process binding to it
sudo lsof -i :1847

If nothing appears in the listening output but you see traffic, a packet capture will tell you more:

sudo tcpdump -n port 1847

The Registered Port Range

Port 1847 sits in the registered ports range (1024–49151). These ports are assigned by IANA upon request for specific services, but they don't carry the same universal recognition as well-known ports (0–1023). Applications can use them without root privileges, which is exactly why SLP Notification was assigned one.

Unlike well-known ports where an unexpected service is a clear anomaly, registered ports can legitimately host things other than their assigned service — applications sometimes choose ports in this range without registering them. Context matters.