12
Summary
- // if you see it open
- No IANA service and no standardised banner, so any daemon listening on 12/tcp is non-standard by definition and worth investigating during a security audit (custom service, misconfiguration, or obscure backdoor). No CVEs or exploitation frameworks specifically target 12/tcp, and its low scan frequency means it is not a routine automated-scanner target.
- // analyst note
- An open port 12 is statistically rare and maps to no known protocol — treat any responsive 12/tcp as non-standard and investigate.
About port 12/tcp.
Port 12/tcp is listed as "Unassigned" in the IANA Service Name and Transport Protocol Port Number Registry: it carries no service name, no assignee, no reference, and no registration or modification date — the registry simply reserves the number in the well-known range (0–1023) without allocating it to any standardised protocol. Both 12/tcp and 12/udp appear in the registry with the same Unassigned status, and the Reference column is genuinely blank in the source (not omitted — IANA cites no RFC for this entry). Port 12 sits in a stretch of low-numbered ports that historically carried legacy Unix diagnostic services — port 11/tcp is systat, port 13/tcp is daytime, and nearby ports map to other small services — but port 12 itself was skipped and has never had a service name on record. For an analyst, the practical consequence is that nothing standard should ever answer on 12/tcp. Nmap's nmap-services database lists 12/tcp as "unknown" with an empirically observed open-frequency around 0.000063, making it one of the rarest ports seen open in active internet scans, and there are no CVEs or exploitation frameworks that specifically target it. Because the port is unassigned and carries no standardised banner, any daemon found listening on 12/tcp is non-standard by definition and should be treated as worth investigating during a security audit — a custom service, a misconfiguration, or a deliberately obscure backdoor — rather than dismissed as a known protocol. Its very low scan frequency also means it is not a routine automated-scanner target.
- IANA assignment
- Unassigned — no service name, no assignee, no reference; dual-listed 12/tcp + 12/udp, both Unassigned (Reference column blank — not fabricated) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry
- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 12/tcp ≈ 0.000063 (very low — among the rarest in active scans) [Confirmed] — nmap-services file
- Related ports
- legacy small/diagnostic services nearby (11/tcp systat, 13/tcp daytime); the small-services cluster
Primary use
none — no IANA-assigned service has ever been allocated to port 12
Other/unofficial uses
Unknown — no standard software or daemon is canonically associated with 12/tcp
Security implications
no CVEs or exploitation frameworks specifically target 12/tcp; because it is unassigned and bannerless, any listener is non-standard and warrants investigation in an audit; low scan frequency means it is not a routine probe target
Typically seen on
nothing standard — an open 12/tcp is an anomaly / possible custom service or backdoor
- Analyst note
- An open port 12 is statistically rare and maps to no known protocol — treat any responsive 12/tcp as non-standard and investigate.
About port 12/udp.
Port 12/udp is listed as "Unassigned" in the IANA Service Name and Transport Protocol Port Number Registry: it carries no service name, no assignee, no reference, and no registration or modification date — the registry simply reserves the number in the well-known range (0–1023) without allocating it to any standardised protocol. Both 12/udp and 12/tcp appear in the registry with the same Unassigned status, and the Reference column is genuinely blank in the source (not omitted — IANA cites no RFC for this entry). Port 12 sits in a stretch of low-numbered ports that historically carried legacy Unix diagnostic services — port 11/udp is systat (Active Users) and port 13/udp is daytime (Daytime Protocol) — but port 12 itself was skipped and has never had a service name on record on either transport. For an analyst, the practical consequence is that nothing standard should ever answer on 12/udp. Because UDP is connectionless, a port carries no listening-state handshake the way TCP does, so closed/filtered UDP ports are routinely silent and any reply at all on 12/udp is itself unusual. No CVEs, exploitation frameworks, or amplification/reflection advisories specifically target this port number, and SANS Internet Storm Center shows no notable scan campaign tied to it. Because the port is unassigned and carries no standardised banner or service, any datagram traffic observed on 12/udp is non-standard by definition — misconfiguration, a proprietary service, spoofed-source scanning noise, or a deliberately obscure channel — and is worth investigating during a security audit rather than dismissed as a known protocol.
- IANA assignment
- Unassigned — no service name, no assignee, no reference; dual-listed 12/tcp + 12/udp, both Unassigned (Reference column blank — not fabricated) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 29; 12/tcp line 28)
- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- not among commonly observed/targeted UDP ports; SANS ISC reports no notable activity specific to 12/udp (no local nmap-services open-frequency figure on record, so none is asserted) [Likely] — SANS Internet Storm Center port data
- Related ports
- legacy small/diagnostic services nearby (11/udp systat, 13/udp daytime); the small-services cluster
Primary use
none — no IANA-assigned service has ever been allocated to port 12 on UDP
Other/unofficial uses
Unknown — no standard software or daemon is canonically associated with 12/udp
Security implications
no CVEs, exploitation frameworks, or amplification/reflection advisories specifically target 12/udp; because it is unassigned and bannerless, any datagram traffic is non-standard and warrants investigation in an audit
Typically seen on
nothing standard — observed traffic on 12/udp is an anomaly / misconfiguration, proprietary use, or scanning noise
- Analyst note
- Port 12/udp maps to no known protocol and UDP gives no listening-state signal — treat any traffic on it as non-standard and investigate.