> Source: [sk102729](https://support.checkpoint.com/results/sk/sk102729)

# sk102729 - VPND daemon listens for "Tunnel Test" traffic (UDP port 18234) on cluster Sync interface

| Property | Value |
|----------|-------|
| Solution ID | sk102729 |
| Date Created | 2014-10-02 |
| Last Modified | 2014-10-05 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- Output of '`netstat -anp`' command ('`netstat -anb`' on Windows OS) shows that VPND daemon listens for "Tunnel Test" traffic (UDP port 18234) on cluster Sync interface.  
Note: Check Point "Tunnel Test" protocol is used for testing ICA through VPN by SecuRemote/SecureClient.

## Cause

By design, VPND daemon selects the first physical interface (except Loopback and VTI) it finds and binds a listening socket to it. In addition, VPND daemon adds a NAT rule, which translates the traffic accordingly once it arrives.

If the first interface (as listed in the output of the '`fw ctl iflist`' command / '`ifconfig -a`' command) happens to be the cluster Sync interface, then it will be selected.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content