15
Summary
- // if you see it open
- Port 15/tcp is unassigned and carries no legitimate active service, so any open state on a live host is anomalous and warrants investigation (mis-configured legacy daemon, port-scan artifact, or backdoor). No specific CVEs or known exploits are associated with the historical netstat service. The legacy concept of exposing host network state to unauthenticated remote clients would be information-disclosing if ever active (plausible inference, not a sourced advisory).
- // analyst note
- An open port 15 is statistically rare and has no legitimate modern service — treat as a fingerprinting/anomaly signal and investigate; legitimate use is unlikely.
About port 15/tcp.
Port 15/tcp is listed in the IANA Service Name and Transport Protocol Port Number Registry with no service name and the description "Unassigned [was netstat]"; the assignee, reference, and date columns are all blank, and there is no matching UDP registration in the cached registry. The bracketed annotation records a historical, now-retired use: early ARPANET assigned-numbers documents associated port 15 with a remote "netstat" service — a lightweight scheme for querying a host's network connection state, routing tables, and interface statistics over the network. RFC 1340 (Assigned Numbers, J. Reynolds and J. Postel, July 1992) is the historical reference where the port appears annotated "Unassigned [was netstat]," and Wikipedia's port list cites the same lineage. That remote-query concept predates and is unrelated to the modern netstat command-line utility, which runs locally and does not listen on any network port; the proposed service was never given a standardized wire protocol and was never widely deployed in production. There is no RFC cited in the IANA Reference column for an active assignment, so that field stays blank. The reason port 15 matters for an analyst is almost entirely negative: because it is unassigned and carries no legitimate active service, virtually no modern system should be listening on it, so a responsive port 15/tcp during a scan is anomalous and worth investigating as a mis-configured legacy daemon, a port-scan artifact, or a possible backdoor rather than a normal service. No specific CVEs or known exploits attach to the historical netstat service itself; the only security characterization in the wild is the reasonable observation that exposing host network state to unauthenticated remote clients would be information-disclosing if the service were ever active — a plausible inference, not a sourced advisory, so it is tagged accordingly.
- IANA assignment
- none — service name blank; description "Unassigned [was netstat]"; reference blank (no RFC cited in IANA registry); no assignee; not dual-registered (no 15/udp entry — 15/udp is plain "Unassigned") [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry row 34)
- Range class
- well-known (0–1023)
- Prevalence
- nmap-services observed open-frequency 15/tcp ≈ 0.000038 (very low — roughly 4 in 100,000 scanned hosts in the nmap-services sample), carried under the dataset's historical
netstatlabel; there is no 15/udp row in the dataset at all, matching the registry's plain "Unassigned" UDP status [Confirmed] — nmap-services dataset. The figure records scan-observed openness on the port number, not a legitimate service, and at that magnitude it corroborates the statistically-rare reading [Confirmed] - Related ports
- the small-services cluster (7, 9, 11, 13, 17, 19, 37); adjacent Unassigned ports 14 and 16
Primary use
none current; historically a proposed remote "netstat" network-status query service (connection state, routing tables, interface stats)
Other/unofficial uses
Unknown — no known production daemon or widely distributed software implemented this port; the historical remote-netstat concept is distinct from the local netstat CLI tool [Confirmed]
Security implications
no active legitimate service, so any open state on a live host is anomalous and warrants investigation (mis-configured legacy daemon, scan artifact, or backdoor); no specific CVEs or exploits associated with the historical netstat service; the legacy concept of exposing network state to unauthenticated remote clients would be information-disclosing if ever active
Typically seen on
nothing in normal operation; an open port 15 is an anomaly / possible backdoor or decoy
- Analyst note
- An open port 15 is statistically rare and has no legitimate modern service — treat as a fingerprinting/anomaly signal and investigate; legitimate use is unlikely.
About port 15/udp.
Port 15/udp is listed in the IANA Service Name and Transport Protocol Port Number Registry as Unassigned, with no service name, no assignee, no reference, and no registration or modification dates — every optional column on the row is genuinely blank. The historical context lives on the TCP counterpart: 15/tcp is recorded as "Unassigned [was netstat]," and that "was netstat" note appears only on the TCP row, not the UDP row. Historically the assigned-numbers lineage (RFC 1340 and its predecessors) tied port 15 to netstat, an early remote Network Status Protocol that reported a host's network state — socket status, routing tables, ARP tables, multicast group membership, per-protocol statistics, and interface status — to a remote caller, conceptually a sibling of the systat service on port 11. That service was an information-disclosure liability: it handed detailed internal network topology to unauthenticated remote callers, which is why netstat-on-port-15 was deprecated, the assignment was withdrawn, and the port is unassigned today. For an analyst, 15/udp is effectively dead space. There is no widely documented modern software that binds it, no specific malware associated with it, and contemporary scan telemetry treats it as a low-interest target since the legacy service is obsolete and rarely open. The practical relevance is the inverse of an active service: 15 is a port to confirm closed in a firewall audit, and a host answering on it most likely indicates a legacy or misconfigured system whose remnant service should be disabled rather than a normal, expected listener.
- IANA assignment
- Unassigned — no service name, no assignee, blank reference, no dates; the row's optional columns are all blank in the cached IANA registry [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 35)
- Range class
- well-known (0–1023) [Confirmed]
- Related ports
- the small-services / status cluster (systat 11, daytime 13, qotd 17, chargen 19); contrast modern host-status mechanisms
Primary use today
none — the port is unassigned and not used in modern networks
Other/unofficial uses
historically tied to early Unix/BSD network daemons exposing netstat output remotely; no documented modern software binds it
Security implications
the legacy netstat service was an information-disclosure risk (exposed internal routing/ARP/socket/interface state to unauthenticated callers); guidance recommends disabling and blocking port 15; no specific malware/trojan association is documented; modern relevance is as a port to confirm closed in firewall audits
Typically seen on
legacy or misconfigured hosts; otherwise an anomaly — not an expected service
- TCP/UDP dual-registration
- 15/tcp is "Unassigned [was netstat]"; the historical netstat note is on the TCP row only, the UDP row carries no note [Confirmed] — IANA registry (the IANA Service Name and Transport Protocol Port Number Registry line 34)
- Historical use
- port 15 was historically assigned to netstat, a remote Network Status Protocol reporting socket status, routing/ARP tables, multicast membership, per-protocol statistics, and interface status (analogous to systat on port 11); now withdrawn/unassigned[Confirmed] — RFC 1340; auditmypc port-15 reference; HandWiki list of TCP/UDP port numbers
- Scanning exposure
- not a high-frequency scan target in contemporary threat intelligence; service obsolete, exposure negligible on modern systems; an open 15/udp likely indicates a legacy or misconfigured host [Likely] — auditmypc port-15 reference
- Analyst note
- 15/udp is effectively dead space — confirm closed in audits; a responsive host most likely runs a legacy remnant that should be disabled.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| netstat | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.