Port No. | Protocol | Service | Description |
500 | tcp/udp | isakmp | isakmp |
500 |
udp |
# |
Cisco Systems |
501 | tcp/udp | stmf | STMF |
502 | tcp/udp | asa-appl-proto | asa-appl-proto |
503 | tcp/udp | intrinsa | Intrinsa |
504 | tcp/udp | citadel | citadel |
505 | tcp/udp | mailbox-lm | mailbox-lm |
506 | tcp/udp | ohimsrv | ohimsrv |
507 | tcp/udp | crs | crs |
508 | tcp/udp | xvttp | xvttp |
509 | tcp/udp | snare | snare |
510 | tcp/udp | fcp | FirstClass Protocol |
511 | tcp/udp | passgo | PassGo |
511 |
tcp |
# |
Part of rootkit t0rn, a program called
"leeto's socket daemon" runs at this port. |
512 | tcp | exec | remote process execution; authentication
performed using passwords and UNIX login names |
512 | udp | comsat | |
512 | udp | biff | used by mail system to notify users of
new mail received; currently receives
messages only from processes on
the same machine |
513 | tcp | login | "remote login a la telnet; automatic
authentication performed based on
priviledged port numbers and
distributed data bases which
identify ""authentication domains""" |
513 | udp | who | maintains data bases showing who's logged in to
machines on a local net and the load average
of the machine |
513 |
tcp |
# |
Grlogin |
514 | tcp | shell | "cmd like exec, but automatic authentication is
performed as for login server" |
514 |
tcp |
# |
RPC Backdoor |
514 | udp | syslog | |
515 | tcp/udp | printer | spooler |
516 | tcp/udp | videotex | videotex |
517 | tcp/udp | talk | "like tenex link, but across machine - unfortunately,
doesn't use link protocol (this is actually just a
rendezvous port from which a tcp connection is established)" |
518 | tcp/udp | ntalk | |
519 | tcp/udp | utime | unixtime |
520 | tcp | efs | extended file name server |
520 | udp | router | local routing process (on site); uses variant of
Xerox NS routing information protocol - RIP |
521 | tcp/udp | ripng | ripng |
522 | tcp/udp | ulp | ULP |
523 | tcp/udp | ibm-db2 | IBM-DB2 |
524 | tcp/udp | ncp | NCP |
525 | tcp/udp | timed | timeserver |
526 | tcp/udp | tempo | newdate |
527 | tcp/udp | stx | Stock IXChange |
528 | tcp/udp | custix | Customer IXChange |
529 | tcp/udp | irc-serv | IRC-SERV |
530 | tcp/udp | courier | rpc |
531 | tcp/udp | conference | chat |
531 |
tcp |
# |
Net666, Rasmin |
532 | tcp/udp | netnews | readnews |
533 | tcp/udp | netwall | for emergency broadcasts |
534 | tcp/udp | mm-admin | MegaMedia Admin |
535 | tcp/udp | iiop | iiop |
536 | tcp/udp | opalis-rdv | opalis-rdv |
537 | tcp/udp | nmsp | Networked Media Streaming Protocol |
538 | tcp/udp | gdomap | gdomap |
539 | tcp/udp | apertus-ldp | Apertus Technologies Load Determination |
540 | tcp/udp | uucp | uucpd |
541 | tcp/udp | uucp-rlogin | uucp-rlogin |
542 | tcp/udp | commerce | commerce |
543 | tcp/udp | klogin | |
544 | tcp/udp | kshell | krcmd |
545 | tcp/udp | appleqtcsrvr | appleqtcsrvr |
546 | tcp/udp | dhcpv6-client | DHCPv6 Client |
547 | tcp/udp | dhcpv6-server | DHCPv6 Server |
548 | tcp/udp | afpovertcp | AFP over TCP |
549 | tcp/udp | idfp | IDFP |
550 | tcp/udp | new-rwho | new-who |
551 | tcp/udp | cybercash | cybercash |
552 | tcp/udp | devshr-nts | DeviceShare |
553 | tcp/udp | pirp | pirp |
554 | tcp/udp | rtsp | Real Time Stream Control Protocol |
555 | tcp/udp | dsf | |
555 |
tcp/udp |
# |
Trojan: phAse Zero
711 trojan (Seven Eleven), Ini-Killer,
Net Administrator,
Phase Zero, Phase-0, Stealth Spy |
556 | tcp/udp | remotefs | rfs server |
557 | tcp/udp | openvms-sysipc | openvms-sysipc |
558 | tcp/udp | sdnskmp | SDNSKMP |
559 | tcp/udp | teedtap | TEEDTAP |
559 |
tcp |
# |
Domwis, Solufina |
560 | tcp/udp | rmonitor | rmonitord |
561 | tcp/udp | monitor | |
562 | tcp/udp | chshell | chcmd |
563 | tcp/udp | nntps | nntp protocol over TLS/SSL (was snntp) |
564 | tcp/udp | 9pfs | plan 9 file service |
565 | tcp/udp | whoami | whoami |
566 | tcp/udp | streettalk | streettalk |
567 | tcp/udp | banyan-rpc | banyan-rpc |
568 | tcp/udp | ms-shuttle | microsoft shuttle |
569 | tcp/udp | ms-rome | microsoft rome |
570 | tcp/udp | meter | demon |
571 | tcp/udp | meter | udemon |
572 | tcp/udp | sonar | sonar |
573 | tcp/udp | banyan-vip | banyan-vip |
574 | tcp/udp | ftp-agent | FTP Software Agent System |
575 | tcp/udp | vemmi | VEMMI |
576 | tcp/udp | ipcd | ipcd |
577 | tcp/udp | vnas | vnas |
578 | tcp/udp | ipdd | ipdd |
579 | tcp/udp | decbsrv | decbsrv |
580 | tcp/udp | sntp-heartbeat | SNTP HEARTBEAT |
581 | tcp/udp | bdp | Bundle Discovery Protocol |
582 | tcp/udp | scc-security | SCC Security |
583 | tcp/udp | philips-vc | Philips Video-Conferencing |
584 | tcp/udp | keyserver | Key Server |
585 | tcp/udp | imap4-ssl | IMAP4+SSL (use 993 instead) |
586 | tcp/udp | password-chg | Password Change |
587 | tcp/udp | submission | Submission |
588 | tcp/udp | cal | CAL |
589 | tcp/udp | eyelink | EyeLink |
590 | tcp/udp | tns-cml | TNS CML |
591 | tcp/udp | http-alt | "FileMaker, Inc. - HTTP Alternate (see Port 80)" |
592 | tcp/udp | eudora-set | Eudora Set |
593 | tcp/udp | http-rpc-epmap | HTTP RPC Ep Map |
594 | tcp/udp | tpip | TPIP |
595 | tcp/udp | cab-protocol | CAB Protocol |
596 | tcp/udp | smsd | SMSD |
597 | tcp/udp | ptcnameservice | PTC Name Service |
598 | tcp/udp | sco-websrvrmg3 | SCO Web Server Manager 3 |
599 | tcp/udp | acp | Aeolon Core Protocol |