TCP port 10002

[blaroche]

I am trying to document/justify all open port on my systems and I am finding all of my IOS Switches are running TCP 10002

show ip socket | include listen

17 ‐‐listen‐‐ 192.168.251.251 123 0 0 1001 0

17(v6) ‐‐listen‐‐ ‐‐any‐‐ 123 0 0 20001 0

17 ‐‐listen‐‐ 192.168.251.251 10002 0 0 11 0

17 ‐‐listen‐‐ 192.168.251.251 162 0 0 1011 0

17 ‐‐listen‐‐ 192.168.251.251 58922 0 0 1011 0

17(v6) ‐‐listen‐‐ ‐‐any‐‐ 161 0 0 20001 0

17(v6) ‐‐listen‐‐ ‐‐any‐‐ 162 0 0 20011 0

17(v6) ‐‐listen‐‐ ‐‐any‐‐ 64076 0 0 20001 0

17 ‐‐listen‐‐ 192.168.251.251 1645 0 0 1011 0

17(v6) ‐‐listen‐‐ ‐‐any‐‐ 1645 0 0 20011 0

17 ‐‐listen‐‐ 192.168.251.251 1646 0 0 1011 0

17(v6) ‐‐listen‐‐ ‐‐any‐‐ 1646 0 0 20011 0

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

Can't find any documentation on this.  Anyone know what it is?

thanks

[acampbell]

Hi,

Look at your table- the 1st column tells you that the protocol number is 17 == UDP

UDP 10002 is in the registered port section of the port allocations.

Looking at the IANA web site

https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?&page=116

EMC have registered their interest in this port as part of their EMC-Documentum Content Server Product

Hope this helps

Regards

Alex

[blaroche]

Finally got the final answer on this question:

"Port 10002 may be related to the Cluster Management protocol. the command 'no cluster run' can be used to disable this port. Cluster Management is served as a type of web-frontend for Cisco device, however it is currently no longer sold/supported. Disabling this protocol should not affect the function of the switch, or the stacking mechanism."

I ran the command and the port turned disappeared from the command output within about 10 seconds.

[Gerard Gasca]

cluster run

Use the cluster run global configuration command to enable clustering on a switch. Use the no form of

this command to disable clustering on a switch

cluster run

no cluster run

When you enter the no cluster run command on a cluster command switch or cluster command switch

stack, the cluster command switch is disabled. Clustering is disabled, and the switch cannot become a

candidate switch.

When you enter the no cluster run command on a cluster member switch, it is removed from the cluster.

Clustering is disabled, and the switch cannot become a candidate switch.

When you enter the no cluster run command on a switch that is not part of a cluster, clustering is

disabled on this switch. This switch cannot then become a candidate switch.

Does not appear to be usable on a cluster to close that port. What configuration was this tested on?