10500
Summary
- // if you see it open
- RFC 5770 describes UDP-encapsulated HIP signaling and ESP data, ICE-based connectivity checks, and optional HIP relay signaling. The supplied evidence does not establish host deployment, reachability, or malicious use.
About port 10500/udp.
IANA registers UDP port 10500 as hip-nat-t, described as “HIP NAT-Traversal.” That identifies the intended protocol role, but does not show that a host is running it or whether it should be reachable from the public internet. The recommended exposure policy is therefore Unknown based on the supplied evidence.
RFC 5770 describes experimental Host Identity Protocol (HIP) extensions for traversing NATs. They use UDP encapsulation for HIP signaling and ESP data, ICE-style connectivity checks, and may use a HIP relay server for signaling. This explains the registered service label; it does not establish how often the protocol is deployed.
RFC 9028 describes a later experimental native NAT traversal mode for HIP, using HIP messages for connectivity checks and related procedures. The supplied excerpts do not establish that RFC 9028 traffic specifically uses UDP 10500. Both RFCs are experimental specifications, not evidence of a particular deployment or of malicious activity.
- Registered service
hip-nat-t— HIP NAT-Traversal is the IANA description for UDP 10500. [Confirmed]- Protocol role
- HIP NAT traversal can use UDP encapsulation for signaling and ESP data; RFC 5770 describes ICE-based checks and optional HIP relaying. [Confirmed]
- Exposure
- Unknown — registration and protocol specifications do not establish the intended audience or observed reachability of a host on this port.
- Prevalence and malware
- Unknown — no scoped measurement or malware evidence was supplied.
- Service name
hip-nat-t[Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Protocol behavior
RFC 5770 specifies experimental HIP NAT traversal extensions, including UDP encapsulation
- Description
- HIP NAT-Traversal [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
- Later mode
- RFC 9028 specifies a native experimental HIP NAT traversal mode [Confirmed] — https://www.rfc-editor.org/rfc/rfc9028.txt
- Deployment and public reachability
- Unknown [Unknown] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| hip-nat-t | TCP | HIP NAT-Traversal | 0.01% |
| hip-nat-t | UDP | HIP NAT-Traversal | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.