1521

Port 1521/tcp carries one of the sharpest gaps in the IANA registry between the assigned name and the real-world traffic. IANA registers 1521 (dual TCP+UDP) as ncube-lm — "nCube License Manager," assignee Maxine Yuen — with a blank reference field and a modification date of 2022-02-14; the registration-date column is blank. The registry also stamps 1521 with an "Unauthorized Use Known on port 1521" note, an explicit acknowledgement that the dominant occupant is not nCube but Oracle. In practice 1521/tcp is the default Oracle Net (TNS — Transparent Network Substrate, formerly SQL*Net / Net8) Listener port: the Listener accepts client connection requests, dynamically registers database services, dispatches connections to the right instance, and underpins Oracle RAC load balancing and failover. Clients reach it through SQL\*Plus, SQL Developer, Toad, and the Oracle JDBC/ODBC drivers. Oracle's own *officially assigned* IANA port is 2483/2484, but 1521 persists as the deployed default for backward compatibility, so for an analyst a responsive 1521 almost always means an Oracle database. That makes it a high-value target: enumeration tooling (tnscmd10g.py, Nmap oracle-tns-version, Metasploit tnslsnr_version, odat.py) probes SIDs and service names before credential attacks, and the listener has a long CVE history — most notably TNS Listener Poisoning, CVE-2012-1675, where an attacker registers a rogue service to hijack client connections. Direct internet exposure is comparatively contained: a 2025 assessment found roughly 40 servers worldwide exposing a vulnerable TCPS listener on 1521.

IANA assignment

ncube-lm — "nCube License Manager"; reference (blank — no RFC cited in IANA registry); assignee/contact [Maxine_Yuen]; dual-registered 1521/tcp + 1521/udp; modification date 2022-02-14; registration date blank [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered (1024–49151)

Primary use (de facto)

Oracle Net / TNS Listener — default listening port for Oracle Net Services (formerly SQL\*Net / Net8); accepts client connections, dynamically registers services, dispatches to instances, supports RAC load balancing/failover

Common software

Oracle Database Server (all major versions), SQL\*Plus, SQL Developer, Toad for Oracle, Oracle JDBC thin/ODBC drivers, Oracle RAC; ports 1522–1529 used in multi-listener setups

Security implications

high-value target for SID/service-name enumeration (tnscmd10g.py, Nmap oracle-tns-version, Metasploit tnslsnr_version, odat.py), credential brute-forcing, TNS Listener Poisoning, listener DoS; routinely scanned (Shodan indexes 1521)

Notable CVEs

CVE-2012-1675 (High, TNS Listener Poisoning); CVE-2012-3150 (TNS RCE); CVE-2014-6578 (listener crash/DoS); CVE-2023-21837 (SQL Developer); CVE-2025-30733 (uninitialized memory read in TCPS listener; affects 19.3–19.26, 21.3–21.17, 23.4–23.7; patched 2025-04-15)

IANA "Unauthorized Use Known on port 1521" note present — registry acknowledges non-nCube (Oracle TNS) traffic dominates [Confirmed] — IANA registry CSV

Oracle's officially assigned IANA port is 2483/2484; 1521 is the legacy/de-facto default retained for backward compatibility [Confirmed] — IANA registry; whatportis

Internet exposure

relatively contained — a 2025 research assessment found ~40 servers worldwide directly exposing a vulnerable TCPS listener on 1521 [Likely] — scanitex (single-source figure)

Analyst note

A responsive 1521 almost always indicates an Oracle database despite the IANA ncube-lm name. Treat as a database-listener fingerprint; restrict to trusted subnets and patch the listener.

Port 1521/udp is registered with IANA as ncube-lm with the description "nCube License Manager," assignee/contact Maxine Yuen, and a blank reference field; it is dual-registered on TCP and UDP (1521/tcp carries the identical assignment). The registrant is nCUBE, a parallel-computing and video-on-demand hardware company founded in 1983 in Beaverton, Oregon and acquired by C-COR in January 2005 — so the assignment is essentially a legacy IANA reservation by a now-defunct vendor. The IANA registry explicitly flags "Unauthorized Use Known on port 1521" for both transports, which captures the central fact an analyst needs: real-world port-1521 traffic is overwhelmingly the Oracle SQL*Net / TNS Listener, and that runs exclusively over TCP, not UDP. Oracle Database clients connect to the TNS Listener on 1521/tcp, which routes connection requests to database instances; Oracle does not use UDP on this port. No evidence of nCube License Manager software actually using 1521/udp in active production was found, and no public scan data, honeypot reports, or threat intelligence specifically documenting 1521/udp traffic or attacks surfaced — all documented scanning, SID enumeration, TNS-listener brute-forcing, default-credential abuse (e.g. CHANGE_ON_INSTALL on Oracle 9), and ODAT-style remote-code-execution activity targets 1521/tcp. For the analyst, then, 1521/udp is best understood as a historical artifact: the registered service is defunct, the dangerous service that gives the port its reputation is TCP-only, and unsolicited UDP on 1521 is unusual and not associated with documented Oracle attack tooling.

IANA assignment

ncube-lm — "nCube License Manager"; reference (blank — no RFC cited in IANA registry); assignee/contact Maxine Yuen; dual-registered 1521/tcp + 1521/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry (registry row 2766; tcp twin at row 2765)

Range class

registered (1024–49151)

IANA registry note

"Unauthorized Use Known on port 1521" flagged for both TCP and UDP [Confirmed] — IANA registry

Related ports

1521/tcp (Oracle TNS, the consequential twin); 1525/1526 (Oracle alt listener); 2483/2484 (Oracle TTC, TLS)

Primary use

registered service is nCube License Manager (defunct vendor nCUBE, acquired by C-COR Jan 2005); no evidence of active 1521/udp deployment

Other/unofficial uses

dominant real-world use of port 1521 is Oracle SQL*Net / TNS Listener — but exclusively over TCP, not UDP

Security implications

scanning and attack activity (SID enumeration, TNS-listener brute force, default creds, ODAT RCE) apply to 1521/tcp (Oracle); SANS ISC threat level green mid-2026; UK NCSC flags open 1521/tcp as an Oracle-exposure indicator; no 1521/udp-specific scanning or exploitation documented

Registry dates

registration/assignment date blank in registry (Unknown); registry modification/last-updated date 2022-02-14 [Confirmed] — IANA registry

UDP-specific activity

Unknown — no scan/honeypot/threat-intel evidence of real 1521/udp traffic found

Analyst note

1521/udp's registered service is a defunct vendor's license manager; the port's reputation comes entirely from Oracle TNS on TCP. Treat unsolicited 1521/udp as anomalous and unrelated to documented Oracle attack tooling.