158
Summary
- // if you see it open
- Obsolete, superseded by POP/IMAP, with no meaningful modern footprint. An open 158 is essentially a historical curiosity.
- // analyst note
- Almost never legitimately seen; treat an open 158 as legacy/odd and fingerprint it.
About port 158/tcp.
Port 158/tcp is registered with IANA as pcmail-srv with the description "PCMail Server," assignee Mark L. Lambert, and a blank reference field (dual-registered on TCP and UDP). It is the server side of the PCMail distributed mail system, defined in RFC 1056 (June 1988, M. Lambert, MIT, which obsoletes RFC 993). PCMail was a distributed mail system designed for personal computers and workstations of widely varying capability — from IBM PCs to Suns and MicroVAXes — supporting both an interactive, always-connected mode and a batch mode for clients with intermittent connectivity, with clients synchronizing against a central mail repository via the Distributed Mail System Protocol (DMSP). The IANA reference field is blank. The system is wholly obsolete, long since superseded by POP and IMAP, and it has no meaningful modern footprint. Security-wise there is little to say beyond obsolescence; an open 158 is essentially a historical curiosity. For an analyst, port 158 is almost never legitimately seen today, so a hit should be treated as legacy or anomalous and the actual listening service fingerprinted rather than assumed to be PCMail.
- IANA assignment
pcmail-srv— "PCMail Server"; reference (blank — no RFC cited in IANA registry); assignee Mark L. Lambert; dual-registered 158/tcp + 158/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- rare (de-facto) [Well-established] — nmap-services file
- Related ports
- 110 (pop3), 143 (imap), 25 (smtp); 158/udp sibling
Primary use
PCMail distributed-mail server (RFC 1056); obsolete
Other/unofficial uses
none today [Well-established]
Security implications
obsolete; no meaningful modern footprint [Well-established]
Typically seen on
effectively none; legacy/anomalous
- Analyst note
- Almost never legitimately seen; treat an open 158 as legacy/odd and fingerprint it.
About port 158/udp.
Port 158/udp is registered with IANA as pcmail-srv, described simply as "PCMail Server," with assignee and contact both listed as Mark L. Lambert. The IANA registry's Reference, Registration Date, and Modification Date fields are all blank for this entry — consistent with a well-known-port assignment dating to the pre-1990s era, before IANA consistently logged those fields, rather than an assignment error or omission worth flagging separately. Port 158 is dual-registered on both UDP and TCP under the identical service name, description, and assignee, meaning 158/tcp carries the same profile. The name ties historically to PCMail, an early client/server electronic-mail system built on the mid-1980s Distributed Mail System Protocol (DMSP) lineage, in which a PC-based mail client communicated with a PCMail server to send and retrieve messages — a predecessor-era approach to the client/server email model that POP and IMAP later formalized and displaced industry-wide. No current, actively maintained software was found documented as using UDP/158 for pcmail-srv today; third-party port-lookup aggregators (SpeedGuide, T1 Shopper, AuditMyPC) mirror the bare IANA label without adding independently verifiable detail, so they were not treated as standalone confirmation. No dedicated exposure-scanning literature (Shodan, Censys, or GreyNoise write-ups) or malware-association reporting was found tying this port to any known threat activity — unlike well-known abused ports (445, 3389, 23), port 158 does not appear on common trojan/backdoor port lists. Given its obscurity and the age of the underlying protocol, exposure might be assumed minimal, but the nmap-services dataset does record a measured open-frequency of ≈ 0.010148 for 158/udp — roughly 1 in 100 sampled hosts, and about 160× the ≈ 0.000063 recorded for 158/tcp — so the port answers scans more often than its obscurity suggests, even though nothing identifies what is listening. For an analyst, a responsive UDP/158 today would most plausibly indicate either a legacy PCMail deployment (rare) or an unrelated/non-standard service repurposing the port, and it warrants investigation rather than an assumption of legitimacy.
- IANA assignment
pcmail-srv— "PCMail Server"; reference blank; assignee/contact Mark L. Lambert; dual-registered 158/tcp + 158/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-394; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv- Range class
- well-known (0–1023) [Confirmed]
- Registration/modification dates
- blank in the registry — not fabricated; consistent with a legacy pre-1990s assignment where IANA did not log these fields [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
- Prevalence
- nmap-services observed open-frequency 158/udp ≈ 0.010148 — low, but 67th of 5,615 UDP entries: found open on roughly 1 in 100 sampled hosts, and about 160× the 158/tcp figure of ≈ 0.000063. The figure records how often the port answers a scan, not confirmed PCMail Server use[Likely] — nmap-services dataset
- Related ports
- 158/tcp (identical dual registration under the same service name and assignee) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
Primary use
historically PCMail, an early client/server email system in the Distributed Mail System Protocol (DMSP) lineage
Other/unofficial uses, current software
Unknown — no actively maintained software found documented as using UDP/158 today [Unknown]
Security implications / malware associations
Unknown — no dedicated exposure-scanning (Shodan/Censys/GreyNoise) or malware-association writeups found; port does not appear on common trojan/backdoor port lists [Unknown]
Typically seen on
Unknown/presumed rare — legacy PCMail deployments only, if any remain in service [Unknown]
- Analyst note
- essentially unresearched in modern threat literature; treat a responsive UDP/158 as anomalous and worth investigating rather than assuming legitimacy or risk level.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| pcmail-srv | UDP | PCMail Server | 1.01% |
| pcmail-srv | TCP | PCMail Server | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.