104

Port 104/tcp is registered with IANA as acr-nema with the description "ACR-NEMA Digital Imag. & Comm. 300," assignee and contact Patrick McNamee, and a blank reference field; the same row is dual-registered on 104/udp with identical service name, description, and contact. The name is historical — ACR-NEMA was the joint American College of Radiology / National Electrical Manufacturers Association imaging standard that evolved into DICOM (Digital Imaging and Communications in Medicine), so in practice port 104 carries the DICOM Upper Layer Protocol over TCP/IP: association negotiation (an ACSE subset) followed by DIMSE service operations such as C-STORE, C-FIND, and C-MOVE that move images and queries between imaging modalities (CT, MRI, X-ray scanners) and PACS/VNA archive systems. DICOM PS3.8 (the NEMA network-communication part) strongly recommends binding the well-known port 104 when the operating system permits access to privileged ports, and falling back to the IANA-registered alternate 11112 when it does not; because 104 is privileged (0–1023) and requires root or administrator rights to bind, many real deployments default to 11112, 4242, or a vendor-specific port instead. For an analyst the security posture is the headline: DICOM is unencrypted by default at the protocol level and DICOM nodes have historically accepted associations with weak or no authentication, so Shodan-based research through the 2019–2020 period repeatedly found thousands of internet-facing DICOM servers — some accepting unauthenticated queries that returned patient imaging and PHI (McAfee, Trend Micro, and an AJR study line of reporting). The IANA reference field is blank and no RFC is cited for this assignment; the authoritative protocol source is the NEMA DICOM standard itself rather than an RFC.

IANA assignment

acr-nema — "ACR-NEMA Digital Imag. & Comm. 300"; assignee/contact Patrick McNamee; reference field blank; dual-registered 104/tcp + 104/udp with an identical row [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV, tcp/udp rows)

Range class

well-known (0–1023) [Confirmed] — port number < 1024

IANA RFC reference

none listed — the acr-nema entry carries no RFC reference; leave the IANA Reference column blank [Confirmed] — IANA registry

Related ports

11112/tcp (registered DICOM alternate), 2761/2762 (DICOM ISCL/TLS), 2575 (HL7) in the clinical-systems cluster

Primary use

DICOM (formerly ACR-NEMA) Upper Layer Protocol over TCP/IP — association negotiation plus DIMSE operations (C-STORE, C-FIND, C-MOVE) between imaging modalities and PACS/VNA

Common software

PACS/VNA and modality software implementing the DICOM Upper Layer Protocol (e.g. Orthanc, dcm4chee, Agfa, GE, Philips, Sectra, FUJIFILM Synapse)

Security implications

DICOM is unencrypted by default and nodes historically accept associations with weak/no authentication; 2019–2020 Shodan research found thousands of internet-facing DICOM servers, some returning patient imaging/PHI unauthenticated

Exposure counts

2019-era research cited ~2,000–3,000+ exposed DICOM servers; a secondary 2025 Shodan figure (~3,627) surfaced in a search snippet but could not be verified against a primary source

Typically seen on

hospital/clinic imaging networks — modalities, PACS, VNA, DICOM routers

Official port guidance

DICOM PS3.8 (NEMA) strongly recommends port 104 where privileged-port access is permitted, else the registered alternate 11112; because 104 is privileged, real deployments often use 11112, 4242, or vendor-specific ports [Confirmed] — DICOM PS3.8 chapter 9

Analyst note

an internet-exposed port 104 (or 11112) on a healthcare-adjacent host is a high-value finding — DICOM lacks default encryption and often lacks authentication; investigate for unauthenticated PHI exposure.

Port 104/udp is registered with IANA as acr-nema with the description "ACR-NEMA Digital Imag. & Comm. 300," assignee Patrick McNamee, and a blank reference field. The entry is dual-registered: 104/tcp and 104/udp carry byte-identical registry rows aside from the transport-protocol field, so the UDP row is a paired registration rather than an independently-used transport. The service name traces to ACR-NEMA, the American College of Radiology / National Electrical Manufacturers Association standard that evolved into DICOM (Digital Imaging and Communications in Medicine) — the dominant protocol for transmitting, storing, and querying medical images between imaging modalities (CT/MRI/X-ray scanners), PACS servers, and radiology viewers. The important nuance for an analyst is that DICOM's own defining transport standard, NEMA PS3.8 (DICOM Part 8, the Upper Layer Protocol), specifies TCP/IP exclusively: "The DICOM Upper Layer Protocol ... shall be used in conjunction with the TCP/IP transport layers," with a one-to-one relationship between a TCP connection and an Upper Layer Association. No UDP transport mode is defined in the DICOM standard, so real-world DICOM traffic and exposure on port 104 is TCP-based; 104/udp exists as a reserved companion to the TCP registration and is essentially never a live DICOM path. Security research on DICOM exposure — a 2018 McAfee/Shodan investigation that found over 1,100 unprotected internet-reachable DICOM servers, and Rapid7's study of UK healthcare systems responding on port 104 — all concerns DICOM-over-TCP (port 104/tcp and the unprivileged alternate 11112/tcp), where unencrypted, unauthenticated servers can leak patient imaging and metadata. Those findings do not extrapolate to UDP. For an analyst, a UDP datagram to port 104 is not a normal DICOM interaction; DICOM listeners are TCP, so an open/answering 104/udp warrants scrutiny rather than assumption of benign medical-imaging traffic.

IANA assignment

acr-nema — "ACR-NEMA Digital Imag. & Comm. 300"; reference (blank — no RFC cited in IANA registry); assignee Patrick McNamee; dual-registered 104/tcp + 104/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry / the IANA Service Name and Transport Protocol Port Number Registry lines 275 (tcp) & 276 (udp)

Range class

well-known (0–1023) [Confirmed]

Registration date

Unknown — blank in the source registry row; not surfaced on the IANA page; not fabricated [Unknown] — the IANA Service Name and Transport Protocol Port Number Registry

Related ports

11112/tcp (IANA-registered unprivileged DICOM alternate); the 104/tcp paired registration

Primary use

DICOM (Digital Imaging and Communications in Medicine), formerly ACR-NEMA — medical-image transmission/storage/query between modalities, PACS servers, and viewers

Common software

PACS servers and DICOM SCP/SCU implementations (Orthanc, dcm4che, ClearCanvas) and vendor modality software listening on port 104 (privileged) or the alternate 11112/tcp — TCP-based

Security implications

DICOM-over-TCP internet exposure is a documented healthcare risk (McAfee/Shodan 2018: 1,100+ unprotected servers; Rapid7 UK: 30+ responding on port 104); traffic is unencrypted by default and misconfigured servers expose patient data. All such research is TCP-specific; no equivalent UDP exposure research exists

Typically seen on

healthcare imaging networks (PACS, radiology) — via TCP; an answering 104/udp is anomalous

Transport nuance

DICOM's Upper Layer Protocol standard (NEMA PS3.8 / DICOM Part 8) specifies TCP/IP exclusively; no UDP transport mode is defined. 104/udp is a paired IANA registration, not an actively-used DICOM path [Confirmed] — DICOM PS3.8 §9

Analyst note

DICOM listeners are TCP. A UDP interaction on port 104 is not a normal DICOM path — investigate rather than assume benign medical-imaging traffic.