147

Port 147/tcp is registered with IANA under the service name iso-ip, described simply as "ISO-IP," with both the assignee and contact fields listing [Marshall_Rose]. The registry entry carries no RFC reference and no recorded registration or modification date, a pattern consistent with many System Ports (0–1023) assigned in the pre-1990s era before IANA began systematically tracking those fields — it should be read as an absent record rather than a data-extraction gap. The assignment is dual-registered: the identical service name and description appear on both 147/tcp and 147/udp in the IANA registry. Functionally, ISO-IP refers to carrying ISO's Connectionless-mode Network Protocol (CLNP, ISO 8473) — part of the 1980s-era OSI protocol stack that was a contemporary alternative to TCP/IP — over a TCP or UDP transport. It sits numerically beside other OSI-stack legacy assignments, such as 146/tcp iso-tp0, reinforcing that this cluster of System Ports was reserved during the same OSI-over-Internet experimentation period. Marshall Rose, the listed registrant, was a principal author of ISODE (the ISO Development Environment), a well-known toolkit for running OSI protocols over TCP/IP, which plausibly connects to why this assignment exists, though no source directly ties a specific software implementation to this exact port. ISO-IP/CLNP saw limited real-world deployment, chiefly in telecom and some government/defense OSI-stack networks of that era; it is essentially obsolete on the modern internet, and no evidence of current software binding to this port, malware association, or internet-scan prevalence data was located during this research pass.

IANA assignment

iso-ip — "ISO-IP"; reference (blank — no RFC cited in IANA registry); assignee/contact [Marshall_Rose]; dual-registered 147/tcp + 147/udp [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Range class

well-known (0–1023) [Confirmed] — port number falls in the IANA System Ports range

Assignment/modification date

blank in the IANA registry (no date recorded); not fabricated here [Confirmed — absence verified] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Prevalence / scan telemetry

Unknown — port does not appear in Wikipedia's List of TCP and UDP port numbers (table skips 143→151); no nmap-services frequency or Shodan/scan-telemetry source specific to 147/tcp was found in this pass [Unknown]

Primary use

registered for ISO-IP, i.e. carrying ISO Connectionless Network Protocol (CLNP/ISO 8473) traffic over TCP/UDP, part of the 1980s OSI networking stack

Malware/backdoor associations

Unknown — none found; ISO-IP's obsolescence suggests exposure is presumed negligible, but this is an inference, not a sourced measurement [Unknown]

Related/neighboring assignment

146/tcp iso-tp0, another OSI-stack System Port registered in the same era [Confirmed] — IANA registry (adjacent row)

Registrant background

Marshall Rose was a principal author of ISODE (ISO Development Environment), a toolkit for running OSI protocols over TCP/IP, though no source ties a specific current implementation to this exact port [Likely] — general public record of Marshall Rose's ISODE authorship; not independently re-verified against a dedicated source in this pass

Current software/typical usage

Unknown — no implementation binding to TCP/147 as iso-ip was identified [Unknown]

Port 147 is registered with IANA for both TCP and UDP transports under the service name iso-ip, with the description "ISO-IP," assignee and contact [Marshall_Rose], and no RFC or other reference cited in the registry — the Reference column is blank, as are Registration Date, Modification Date, Service Code, Unauthorized Use Reported, and Assignment Notes. This was confirmed directly from the cached local copy of the IANA Service Name and Transport Protocol Port Number Registry (rows 371–372, the tcp and udp counterparts sitting adjacent with identical metadata), and cross-checked against IANA's live XML and TXT registry views. ISO-IP is generally understood to refer to the ISO Connectionless Network Protocol (CLNP), the OSI protocol stack's rough analog to IP — a legacy of the 1980s–90s OSI networking effort that never displaced TCP/IP and has essentially no footprint in modern deployments; no actively maintained software was found binding to this port today. Third-party port-lookup aggregators (e.g., AuditMyPC) note that port 147 has historically appeared in their databases flagged for past Trojan/virus association, but none identify a specific malware family, CVE, or dated incident, and none confirm current active exploitation — so this should be read as a low-confidence historical flag rather than a live threat. Given the port's obscurity and lack of legitimate modern traffic, an analyst encountering 147/udp open on a host should treat it as anomalous and worth investigating rather than expected.

IANA assignment

iso-ip — "ISO-IP"; reference blank; assignee/contact [Marshall_Rose]; dual-registered 147/tcp + 147/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (rows 371–372); cross-checked https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 147/udp ≈ 0.000511 (very low — roughly 5 in 10,000 scanned hosts in the nmap-services sample) [Confirmed] — nmap-services dataset; the dual-registered 147/tcp row records 0.000000 in the same dataset [Confirmed] — nmap-services dataset

Related ports

147/tcp (identical service name iso-ip, same dual-registration row) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry row 371

Primary use

ISO Connectionless Network Protocol (CLNP) / OSI protocol stack, an IP-layer analog from the legacy OSI networking suite; not part of the modern TCP/IP application ecosystem

Other/unofficial uses

Unknown — no actively maintained or mainstream current software found binding to this port [Unknown]

Security implications

third-party aggregators (AuditMyPC) flag historical Trojan/virus association in their databases; no specific CVE, malware family, or dated incident confirmed; no current active exploitation documented

Typically seen on

Unknown — no current deployment context identified; historically associated conceptually with OSI/CLNP-stack systems only [Unknown]

Analyst note

An open 147/udp is obscure with no confirmed modern legitimate use; treat as anomalous and worth investigating, keeping in mind the unconfirmed historical Trojan association noted by third-party aggregators.