10
Summary
- // if you see it open
- No CVEs, no malware family, and no known exploit campaign specifically target port 10/tcp. It does not appear in nmap top-1000 or common scan/exposure rankings. Any service answering on port 10/tcp in a live environment is a non-standard or custom deployment and warrants investigation, but no known campaign targets this port.
- // analyst note
- Unassigned by IANA; treat a responsive port 10/tcp as a non-standard/custom service worth investigating, not as a known protocol.
About port 10/tcp.
Port 10/tcp carries no IANA assignment: in the IANA Service Name and Transport Protocol Port Number Registry the well-known number 10 is listed as Unassigned for both TCP and UDP, with no service name, no assignee, no RFC or other reference, and no registration or modification dates recorded — every optional column is blank. It sits in the well-known range (0–1023) between port 9 (discard) and port 11 (systat/Active Users), but unlike those neighbors it was never formally allocated to a service. No RFC defines a protocol for it, and the Wikipedia list of TCP/UDP port numbers skips it entirely (jumping from 9 to 11), which corroborates the absence of any conventional or de-facto use. No mainstream server daemon is associated with port 10/tcp, and no trojan or malware family specifically targeting it surfaced in the security databases searched. From a scanning and exposure standpoint it is unremarkable: it does not appear in nmap's default top-1000 list, in Shodan or Shadowserver top-port rankings, or in darknet-telescope highlights, and no CVEs are tied to it. For an analyst the practical reading is that any service answering on port 10/tcp in a live environment is a non-standard or custom deployment — worth investigating precisely because nothing standard listens there — but there is no known exploit campaign aimed at this port. Honest summary: an empty registry slot with no protocol, no software, and no notable threat footprint.
- IANA assignment
- Unassigned — no service name, no assignee, blank reference, no dates; applies to both 10/tcp and 10/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv; xhtml search https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=10)
- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- not present in nmap's default top-1000 ports, nor in Shodan/Shadowserver top-port rankings or darknet-telescope highlights [Likely] — nullsec nmap default top-1000 list (https://nullsec.us/top-1-000-tcp-and-udp-ports-nmap-default/), internet-scan survey (https://arxiv.org/pdf/2510.25050)
- Related ports
- neighbors 9/tcp (
discard) and 11/tcp (systat); the small-services cluster (7, 9, 11, 13, 17, 19, 37)
Primary use
none — no assigned protocol or standard service; no RFC defines a service for this port [Confirmed] — IANA registry; Wikipedia list of TCP/UDP port numbers skips port 10 (https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers)
Other/unofficial uses
Unknown — no mainstream server software or daemon conventionally associated with port 10/tcp [Unknown]
Security implications
no CVEs, no malware family, and no known exploit campaign specifically target port 10/tcp; an open service here is non-standard/custom and warrants investigation
Typically seen on
nothing standard — any listener is a custom or anomalous deployment
- Analyst note
- Unassigned by IANA; treat a responsive port 10/tcp as a non-standard/custom service worth investigating, not as a known protocol.
About port 10/udp.
Port 10/udp is listed by IANA as Unassigned: in the Service Name and Transport Protocol Port Number Registry the 10/udp row carries a blank service name, no assignee, no contact, no registration or modification date, and a blank reference field — it has never held an officially registered service name in any version of the registry. The status is long-standing rather than recent: RFC 1340 (Assigned Numbers, J. Reynolds and J. Postel, July 1992) already recorded both 10/tcp and 10/udp as "Unassigned [JBP]" (Jon Postel), and no later assignment was made. The matching 10/tcp row is identically Unassigned, so the port number is unassigned on both transports. Port 10 sits inside the system / well-known range (0–1023), where most low even-numbered ports were left empty while several adjacent ports received early services (for example 11/udp = systat/Active Users). For an analyst the practical reading is that no protocol or application is officially assigned here and no software legitimately binds to 10/udp by design, so any traffic seen on it is anomalous: it most plausibly reflects a misconfigured custom application that bound to a low port, or broad reconnaissance — Nmap, masscan and Shodan-style sweeps routinely touch low ports including 10/udp without any port-specific exploit being involved. The nmap-services file underscores how rare real usage is: it contains only a low-frequency 10/tcp "unknown" entry (open-frequency on the order of 0.00006) and no 10/udp entry at all, and no malware family, CVE, or threat campaign specific to 10/udp surfaced in current (2024–2026) public sources. A host found listening on 10/udp should therefore be treated as suspicious unless a documented internal application explains it.
- IANA assignment
- Unassigned — blank service name, blank assignee, blank contact, blank registration/modification date, blank reference; identical to the 10/tcp row [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (registries/service-names-port-numbers.csv, 10/udp row)
- Range class
- system / well-known (0–1023) [Confirmed]
- IANA reference
- blank — no RFC cited in the registry (stays blank) [Confirmed] — IANA registry
- Prevalence
- negligible — nmap-services lists only a low-frequency 10/tcp "unknown" entry (~0.00006) and has no 10/udp entry at all [Likely] — nmap-services file
- Related ports
- 10/tcp (also Unassigned); the low system-range neighbours (7, 9, 11, 13, 17, 19) where early services landed
Primary use
none — no protocol or application is officially assigned to 10/udp
Other/unofficial uses
Unknown — no software is known to legitimately bind to 10/udp by design [Unknown]
Security implications
an unassigned low port; any traffic is anomalous and worth flagging. Plausible causes are a misconfigured/custom app bound to a low port or broad scanning (Nmap/masscan/Shodan sweep low ranges). No port-10-specific CVE, malware family, or campaign found in 2024–2026 sources
Exposure
low real-world exposure; internet-wide scan data does not highlight 10/udp as commonly open
- Historical status
- RFC 1340 (Assigned Numbers, July 1992) recorded 10/tcp and 10/udp as "Unassigned [JBP]"; no later assignment was made [Confirmed] — RFC 1340
- Analyst note
- treat a host listening on 10/udp as suspicious absent a documented internal application reason.