| Port No. | Protocol | Service | Description |
| 500 | tcp/udp | isakmp | isakmp |
| 500 |
udp |
# |
Cisco Systems |
| 501 | tcp/udp | stmf | STMF |
| 502 | tcp/udp | asa-appl-proto | asa-appl-proto |
| 503 | tcp/udp | intrinsa | Intrinsa |
| 504 | tcp/udp | citadel | citadel |
| 505 | tcp/udp | mailbox-lm | mailbox-lm |
| 506 | tcp/udp | ohimsrv | ohimsrv |
| 507 | tcp/udp | crs | crs |
| 508 | tcp/udp | xvttp | xvttp |
| 509 | tcp/udp | snare | snare |
| 510 | tcp/udp | fcp | FirstClass Protocol |
| 511 | tcp/udp | passgo | PassGo |
| 511 |
tcp |
# |
Part of rootkit t0rn, a program called
"leeto's socket daemon" runs at this port. |
| 512 | tcp | exec | remote process execution; authentication
performed using passwords and UNIX login names |
| 512 | udp | comsat | |
| 512 | udp | biff | used by mail system to notify users of
new mail received; currently receives
messages only from processes on
the same machine |
| 513 | tcp | login | "remote login a la telnet; automatic
authentication performed based on
priviledged port numbers and
distributed data bases which
identify ""authentication domains""" |
| 513 | udp | who | maintains data bases showing who's logged in to
machines on a local net and the load average
of the machine |
| 513 |
tcp |
# |
Grlogin |
| 514 | tcp | shell | "cmd like exec, but automatic authentication is
performed as for login server" |
| 514 |
tcp |
# |
RPC Backdoor |
| 514 | udp | syslog | |
| 515 | tcp/udp | printer | spooler |
| 516 | tcp/udp | videotex | videotex |
| 517 | tcp/udp | talk | "like tenex link, but across machine - unfortunately,
doesn't use link protocol (this is actually just a
rendezvous port from which a tcp connection is established)" |
| 518 | tcp/udp | ntalk | |
| 519 | tcp/udp | utime | unixtime |
| 520 | tcp | efs | extended file name server |
| 520 | udp | router | local routing process (on site); uses variant of
Xerox NS routing information protocol - RIP |
| 521 | tcp/udp | ripng | ripng |
| 522 | tcp/udp | ulp | ULP |
| 523 | tcp/udp | ibm-db2 | IBM-DB2 |
| 524 | tcp/udp | ncp | NCP |
| 525 | tcp/udp | timed | timeserver |
| 526 | tcp/udp | tempo | newdate |
| 527 | tcp/udp | stx | Stock IXChange |
| 528 | tcp/udp | custix | Customer IXChange |
| 529 | tcp/udp | irc-serv | IRC-SERV |
| 530 | tcp/udp | courier | rpc |
| 531 | tcp/udp | conference | chat |
| 531 |
tcp |
# |
Net666, Rasmin |
| 532 | tcp/udp | netnews | readnews |
| 533 | tcp/udp | netwall | for emergency broadcasts |
| 534 | tcp/udp | mm-admin | MegaMedia Admin |
| 535 | tcp/udp | iiop | iiop |
| 536 | tcp/udp | opalis-rdv | opalis-rdv |
| 537 | tcp/udp | nmsp | Networked Media Streaming Protocol |
| 538 | tcp/udp | gdomap | gdomap |
| 539 | tcp/udp | apertus-ldp | Apertus Technologies Load Determination |
| 540 | tcp/udp | uucp | uucpd |
| 541 | tcp/udp | uucp-rlogin | uucp-rlogin |
| 542 | tcp/udp | commerce | commerce |
| 543 | tcp/udp | klogin | |
| 544 | tcp/udp | kshell | krcmd |
| 545 | tcp/udp | appleqtcsrvr | appleqtcsrvr |
| 546 | tcp/udp | dhcpv6-client | DHCPv6 Client |
| 547 | tcp/udp | dhcpv6-server | DHCPv6 Server |
| 548 | tcp/udp | afpovertcp | AFP over TCP |
| 549 | tcp/udp | idfp | IDFP |
| 550 | tcp/udp | new-rwho | new-who |
| 551 | tcp/udp | cybercash | cybercash |
| 552 | tcp/udp | devshr-nts | DeviceShare |
| 553 | tcp/udp | pirp | pirp |
| 554 | tcp/udp | rtsp | Real Time Stream Control Protocol |
| 555 | tcp/udp | dsf | |
| 555 |
tcp/udp |
# |
Trojan: phAse Zero
711 trojan (Seven Eleven), Ini-Killer,
Net Administrator,
Phase Zero, Phase-0, Stealth Spy |
| 556 | tcp/udp | remotefs | rfs server |
| 557 | tcp/udp | openvms-sysipc | openvms-sysipc |
| 558 | tcp/udp | sdnskmp | SDNSKMP |
| 559 | tcp/udp | teedtap | TEEDTAP |
| 559 |
tcp |
# |
Domwis, Solufina |
| 560 | tcp/udp | rmonitor | rmonitord |
| 561 | tcp/udp | monitor | |
| 562 | tcp/udp | chshell | chcmd |
| 563 | tcp/udp | nntps | nntp protocol over TLS/SSL (was snntp) |
| 564 | tcp/udp | 9pfs | plan 9 file service |
| 565 | tcp/udp | whoami | whoami |
| 566 | tcp/udp | streettalk | streettalk |
| 567 | tcp/udp | banyan-rpc | banyan-rpc |
| 568 | tcp/udp | ms-shuttle | microsoft shuttle |
| 569 | tcp/udp | ms-rome | microsoft rome |
| 570 | tcp/udp | meter | demon |
| 571 | tcp/udp | meter | udemon |
| 572 | tcp/udp | sonar | sonar |
| 573 | tcp/udp | banyan-vip | banyan-vip |
| 574 | tcp/udp | ftp-agent | FTP Software Agent System |
| 575 | tcp/udp | vemmi | VEMMI |
| 576 | tcp/udp | ipcd | ipcd |
| 577 | tcp/udp | vnas | vnas |
| 578 | tcp/udp | ipdd | ipdd |
| 579 | tcp/udp | decbsrv | decbsrv |
| 580 | tcp/udp | sntp-heartbeat | SNTP HEARTBEAT |
| 581 | tcp/udp | bdp | Bundle Discovery Protocol |
| 582 | tcp/udp | scc-security | SCC Security |
| 583 | tcp/udp | philips-vc | Philips Video-Conferencing |
| 584 | tcp/udp | keyserver | Key Server |
| 585 | tcp/udp | imap4-ssl | IMAP4+SSL (use 993 instead) |
| 586 | tcp/udp | password-chg | Password Change |
| 587 | tcp/udp | submission | Submission |
| 588 | tcp/udp | cal | CAL |
| 589 | tcp/udp | eyelink | EyeLink |
| 590 | tcp/udp | tns-cml | TNS CML |
| 591 | tcp/udp | http-alt | "FileMaker, Inc. - HTTP Alternate (see Port 80)" |
| 592 | tcp/udp | eudora-set | Eudora Set |
| 593 | tcp/udp | http-rpc-epmap | HTTP RPC Ep Map |
| 594 | tcp/udp | tpip | TPIP |
| 595 | tcp/udp | cab-protocol | CAB Protocol |
| 596 | tcp/udp | smsd | SMSD |
| 597 | tcp/udp | ptcnameservice | PTC Name Service |
| 598 | tcp/udp | sco-websrvrmg3 | SCO Web Server Manager 3 |
| 599 | tcp/udp | acp | Aeolon Core Protocol |