156

Port 156/tcp is registered with IANA as sqlsrv with the description "SQL Service," assignee Craig Rogers, and a blank reference field (dual-registered on TCP and UDP). The single most important clarification for this port is that it is a generic, early-registered "SQL Service" and is not Microsoft SQL Server, which is registered as ms-sql-s on port 1433 (with ms-sql-m on 1434). It also should not be confused with the similarly named sqlserv ("SQL Services") on port 118, whose assignee is Larry Barnes, nor with sql-net on 150. The IANA reference field is blank. Port 156 predates the modern database-port conventions and is largely vestigial, with essentially no current real-world deployment. Security-wise, the primary risk associated with this port is misattribution: an analyst seeing "SQL" in the service name may wrongly assume a live Microsoft SQL Server, when in practice an open 156 is almost never a modern database at all. For an analyst, an open 156 should be treated as unusual and the actual listening service fingerprinted rather than trusting the registry label — and it must not be conflated with the genuine MS SQL Server surface on 1433.

IANA assignment

sqlsrv — "SQL Service"; reference (blank — no RFC cited in IANA registry); assignee Craig Rogers; dual-registered 156/tcp + 156/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

rare (de-facto) [Well-established] — nmap-services file

Related ports

1433 (ms-sql-s), 1434 (ms-sql-m), 118 (sqlserv — Larry Barnes), 150 (sql-net), 66 (Oracle sqlnet); 156/udp sibling

Primary use

generic/legacy SQL database service registration [Well-established]

Other/unofficial uses

none meaningful today; frequently confused with MS SQL Server (1433) [Well-established]

Security implications

obsolete/rare; primary risk is misattribution (NOT Microsoft SQL Server); an open 156 is almost never a modern database [Well-established]

Typically seen on

rare/legacy hosts; otherwise anomalous

Analyst note

Treat an open 156 as unusual; fingerprint the actual service rather than trusting the registry label. Do not confuse with 1433.

Port 156/udp is registered with IANA under the service name sqlsrv, described simply as "SQL Service," with assignee and contact both listed as [Craig_Rogers]. The registry's Registration Date, Modification Date, and Reference (RFC) columns are blank for this entry — IANA cites no protocol specification, so the assignment reads as a name-only reservation rather than a documented protocol. Port 156 is dual-registered: the identical service name, description, and assignee appear on the TCP side at 156/tcp, a pattern IANA commonly uses for transport-agnostic service reservations. Beyond the official record, third-party port-database sites (not IANA itself) attribute a historical association between this port and IBM's Distributed Data Management (DDM) protocol, used for distributed database access and synchronization within IBM's DB2 product family — this attribution should be treated as secondary and unverified rather than authoritative, since IANA's own registry text says nothing about DDM. No evidence of significant modern, active real-world usage turned up in this pass, and a check against Gary Kessler's well-known "Bad" TCP/UDP Ports List found no match, though that is a single-list absence-of-evidence result rather than a clean bill of health across all threat-intelligence sources. Live scan-prevalence data (e.g., Shodan/Censys exposure counts) was not queried in this light research pass, so real-world exposure prevalence remains an open question for a future cycle.

IANA assignment

sqlsrv — "SQL Service"; reference (blank — no RFC cited in IANA registry); assignee/contact [Craig_Rogers] [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 390; cross-checked against live IANA registry

Range class

well-known (0–1023) [Confirmed]

Dual registration

156/tcp carries the identical service name, description, and assignee/contact [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 389 (tcp), line 390 (udp)

Registration/modification date, Service Code, Unauthorized Use Reported, Assignment Notes

blank in the IANA source; left null rather than fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 390

Primary use

secondary port-database sources attribute historical association with IBM's Distributed Data Management (DDM) protocol for DB2-family distributed database access; not stated or confirmed by IANA itself [Likely] — https://portsmaster.net/port-156/, https://whatportis.com/ports/156_sql-service, http://www.t1shopper.com/tools/port-number/156/

Malware/trojan association

no match found in Gary Kessler's "Bad" TCP/UDP Ports List — a single-list absence-of-evidence result, not a definitive clearance

Modern real-world usage

no evidence of significant current usage found in this light research pass [Unknown]

Scanning/exposure prevalence

not queried in this pass (no Shodan/Censys or nmap-services data pulled) [Unknown]