153

Port 153/tcp is registered with IANA as sgmp with the description "SGMP," assignee Marty Schoffstahl (the registry's spelling; the RFC author is M. Schoffstall), and a blank reference field (dual-registered on TCP and UDP). The Simple Gateway Monitoring Protocol is defined in RFC 1028 (November 1987, J. Davin, J. Case, M. Fedor, M. Schoffstall), an early application-layer protocol for remote monitoring and limited control of internet gateways (routers): it lets a manager inspect and alter integer or octet-string management variables using get, set, and get-response messages plus a trap mechanism. SGMP was explicitly an interim design — the RFC itself cautions that long-term use of its mechanisms should be seriously questioned — and it was the direct precursor to SNMP, which superseded it beginning with RFC 1067 in August 1988. The IANA reference field is blank. The protocol's actual operation was over UDP, with the TCP registration a paired/companion assignment that saw essentially no real use. Security-wise, SGMP is obsolete with a negligible modern footprint; an open 153 today is far more likely to be a misidentified service than genuine SGMP. For an analyst, port 153 is effectively never seen in practice, so a hit should be treated as noise or legacy/lab equipment and the actual listening service fingerprinted rather than assumed to be SGMP.

IANA assignment

sgmp — "SGMP"; reference (blank — no RFC cited in IANA registry); assignee Marty Schoffstahl (registry spelling); dual-registered 153/tcp + 153/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

rare; not in nmap's common-open set (de-facto) [Well-established] — nmap-services file

Related ports

161/162 (snmp/snmptrap, its successor), 160 (sgmp-traps); 153/udp sibling (the operational transport)

Primary use

early gateway/router monitoring (RFC 1028); obsolete

Other/unofficial uses

none today [Well-established]

Security implications

obsolete; negligible footprint; an open 153 is likely a misidentified service [Well-established]

Typically seen on

effectively none; legacy/lab equipment at most

Analyst note

Effectively never seen. If flagged, treat as noise or legacy gear and fingerprint what is actually listening.

Port 153/udp is registered with IANA as sgmp, description "SGMP," assignee and contact [Marty_Schoffstahl], with a blank Reference column — the same assignee, contact, and blank reference also appear on the dual-registered 153/tcp entry. The protocol itself is defined in RFC 1028, "Simple Gateway Monitoring Protocol" (Internet Activities Board; Case, Fedor, Davin, Schoffstall), published November 1987, so the RFC exists even though IANA never back-filled it into the registry's Reference field — the blank field is reported as-is rather than patched with the RFC number. SGMP was an early manager/agent network-management protocol: a manager polled or set simple status variables — interface state, throughput counters, error counts, uptime — on IP gateways using basic GET/SET-style commands carried over UDP. It was short-lived: within about a year it was superseded by SNMP (RFC 1067, August 1988), which added extensibility and structured MIBs, and IANA's companion "SGMP Vendor Specific Codes" registry is explicitly marked Obsolete. Because SGMP predates modern authentication and encryption norms, it carried commands (and any access strings) in plaintext, a design weakness that early SNMP also inherited; no current, actively-maintained software with a default 153/udp listener was identified, and no dated scanning-campaign or CVE data specific to this port turned up; the nmap-services dataset does record a very low observed open-frequency of ≈ 0.000346 for 153/udp (0 for the paired 153/tcp row), and any live-internet exposure claim beyond that figure would be speculation.

IANA assignment

sgmp — "SGMP"; reference (blank — no RFC cited in IANA registry); assignee/contact [Marty_Schoffstahl]; dual-registered 153/tcp + 153/udp with identical assignee/contact/blank reference [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt (registry file cross-checked against local cached copy)

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 153/udp ≈ 0.000346 — very low (roughly 3 in 10,000 scanned hosts in the nmap-services sample); the paired 153/tcp row carries a frequency of 0 (never observed open in the same sample), consistent with SGMP being carried over UDP

[Confirmed] — nmap-services dataset

Related ports

161/udp and 162/udp (SNMP, the successor protocol) [Likely] — reasoned from the RFC 1067 succession relationship, not independently sourced

Primary use

manager/agent polling protocol for basic gateway status (interface state, throughput, errors, uptime) via GET/SET over UDP, defined in RFC 1028 (Nov 1987)

Security implications

plaintext commands and access strings with no real authentication/encryption, a legacy weakness also inherited by early SNMP; no dated scanning-campaign or CVE specific to 153/udp was found, so current exposure prevalence is not established beyond the very low nmap-services open-frequency (≈ 0.000346) recorded above

Typically seen on

legacy 1980s-era IP gateway/router management setups; effectively retired on the modern internet [Likely]

Common software implementations

Unknown — no current vendor product with a default 153/udp listener was identified; secondary port-lookup sources (SpeedGuide, WhatPortIs) list only the bare IANA registration with no named implementations

Malware associations

none identified in this pass

Historical status

obsolete/legacy — superseded within roughly a year by SNMP (RFC 1067, Aug 1988); IANA's related SGMP Vendor Specific Codes registry is marked Obsolete [Confirmed] — https://en.wikipedia.org/wiki/Simple_Gateway_Monitoring_Protocol , https://www.iana.org/assignments/sgmp-vendor-specific-codes/sgmp-vendor-specific-codes.xhtml