119

Port 119/tcp is registered with IANA as nntp with the description "Network News Transfer Protocol," and it is the one port in this batch whose registry row cites an RFC — [RFC3977] — with the assignment held by the IESG and a modification date of 2018-07-06 (dual-registered on TCP and UDP). NNTP transports Usenet news articles between news servers and to and from reader clients. The original protocol was RFC 977 (March 1986, Brian Kantor and Phil Lapsley); the current standard is RFC 3977 (October 2006, C. Feather), which obsoletes RFC 977, folds in the RFC 2980 extensions, adds a CAPABILITIES command, and defaults to UTF-8. It is a stream-based command/response protocol for distributing, querying, retrieving, and posting articles, and its TLS variant runs on port 563 (nntps/snews, via STARTTLS per RFC 4642), while bulk server-to-server transfer historically used NNSP on port 433. Security-wise, NNTP historically used plaintext authentication (encryption arrived via 563/STARTTLS) and has no built-in identity authentication, which is why Usenet has long suffered spam and header forgery. The dominant real-world concern, though, is the abuse of binary newsgroups (the alt.binaries hierarchy) for distributing warez, copyrighted media, and illegal content — commercial providers now advertise retention measured in years and tens of petabytes, and ISPs frequently block alt.binaries to limit traffic and legal exposure, while copyright takedowns must be sent per-server because cancel messages are widely disabled due to abuse. Usenet has declined steeply as users moved to the Web, but it persists for both legitimate discussion and, predominantly, file-sharing. For an analyst, an open 119 indicates a Usenet news server — increasingly rare — and warrants weighing spam, abuse, and copyright considerations, with TLS (563/STARTTLS) preferred over plaintext.

IANA assignment

nntp — "Network News Transfer Protocol"; reference [RFC3977]; assignee IESG; modification date 2018-07-06; dual-registered 119/tcp + 119/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

appears in nmap's default top-1000; declining exposure (de-facto) [Well-established] — nmap-services file

Related ports

563 (nntps / NNTP-over-TLS), 433 (nnsp)

Primary use

Usenet news transport between servers and clients (RFC 3977)

Other/unofficial uses

binary/file distribution via alt.binaries [Well-established/Threat-reported]

Security implications

historically plaintext auth (TLS via 563/STARTTLS); no built-in identity auth → chronic spam/forgery; alt.binaries warez/copyright/illegal-content abuse; ISPs block alt.binaries; per-server takedowns

Typically seen on

Usenet news servers (INN / nnrpd)

Analyst note

An open 119 indicates a Usenet news server — increasingly rare; weigh spam/abuse/copyright considerations and prefer TLS (563/STARTTLS).

Port 119/udp is registered with IANA as nntp with the description "Network News Transfer Protocol," assignee IESG, contact IETF Chair, reference [RFC3977], and a modification date of 2018-07-06; the registry's registration-date column for this row is blank. The same service name and reference are dual-registered on both 119/tcp and 119/udp, so the UDP row mirrors the TCP one. The catch for an analyst is that the UDP assignment is a paper reservation only: RFC 3977 — the authoritative NNTP specification — mandates a reliable, connection-oriented transport and specifies TCP as the standard implementation (the official NNTP port is TCP/119), and it makes no provision for running NNTP over UDP. In practice no NNTP software has ever implemented a UDP transport: Usenet newsreaders (Thunderbird, NNTPGrab, Forte Agent) and server software (INN, Diablo, Cleanfeed) all speak NNTP over TCP/119 or NNTPS over TCP/563. Because nothing legitimately listens on UDP/119 on modern networks, any inbound UDP/119 traffic is either wide-area scanner noise or spoofed/misrouted packets. SANS ISC data for port 119 shows only low-volume opportunistic probing (single digits to a few dozen attempts per top scanner on a given day, green threat level), and third-party UDP port databases flag no virus or trojan tied to UDP/119. The documented NNTP security weaknesses — plaintext ASCII messages open to capture, modification, and forgery, and command meta-character injection on misconfigured servers that allow unprivileged newsgroup creation — are all TCP-side issues. Standard guidance is to block port 119 at the perimeter when NNTP is not in use. For an analyst, a host responding on UDP/119 is anomalous and worth investigating rather than a normal service.

IANA assignment

nntp — "Network News Transfer Protocol"; reference [RFC3977]; assignee [IESG]; contact [IETF_Chair]; modification date 2018-07-06; registration-date column blank; dual-registered 119/tcp + 119/udp

[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached copy, udp line 308 / tcp line 307)

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 119/udp ≈ 0.000428 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 119/tcp row — the transport NNTP actually uses — is roughly eight times more common at ≈ 0.003262 [Confirmed] — nmap-services dataset

Related ports

119/tcp (real NNTP), 563/tcp (NNTPS, NNTP over TLS)

Primary use

none in practice — UDP/119 is a paper reservation mirroring the TCP entry; RFC 3977 specifies NNTP over TCP only and makes no provision for UDP

Other/unofficial uses

none known — no NNTP software implements a UDP transport; all clients/servers use TCP/119 or NNTPS TCP/563

Security implications

documented NNTP weaknesses (plaintext messages open to capture/modification/forgery; command meta-character injection on misconfigured servers) are TCP-side; no virus/trojan associated with UDP/119; any inbound UDP/119 is scanner noise or spoofed/misrouted traffic

Exposure / scanning

SANS ISC shows low-volume opportunistic probing of port 119 (single digits to ~28 probes/day from top scanners, green threat level); no documented campaign targeting UDP/119

Typically seen on

not a normal listener on modern networks; an open/responsive UDP/119 is an anomaly worth investigating

Analyst note

Block port 119 at the perimeter if NNTP is not in use; treat a responsive UDP/119 as anomalous (scanner noise, spoofing, or misconfiguration) rather than a legitimate service.