160
Summary
- // if you see it open
- SGMP's RFC 1028 authentication scheme was plaintext. Genuine SGMP traffic is effectively extinct (superseded by SNMP/RFC 1157 circa 1990), so a live port 160 today is more likely scanner noise, a honeypot artifact, or an unrelated/misconfigured service than real SGMP. Generic 'malicious activity' claims on low-quality port-database sites carry no specific CVE/malware citation and are treated as unverified.
- // analyst note
- An open TCP/UDP 160 should not be assumed to be genuine SGMP traffic — SGMP has been Historic for three decades with no current implementations found; investigate as scanner/honeypot noise or a misconfigured/unrelated service [Likely]
About port 160/tcp.
Port 160/tcp is registered with IANA as sgmp-traps ("SGMP-TRAPS"), assignee and contact [Marty_Schoffstahl] (also spelled Schoffstall elsewhere), with the Registration Date, Modification Date, Reference, Service Code, Unauthorized Use Reported, and Assignment Notes fields all blank in the registry — no RFC is cited and no date is recorded, so none is invented here. The same name/description is dual-registered on 160/udp. SGMP is the Simple Gateway Monitoring Protocol, defined in RFC 1028 (M. Schoffstahl, SRI-NIC, November 1987) as an interim, IETF-non-endorsed stopgap for polling gateway status pending a more permanent solution. RFC 1028's text itself specifies only UDP port 153 for the SGMP request/response entity; the pairing of 160 with "traps" (unsolicited notifications such as cold/warm start, link failure, authentication failure, and EGP neighbor loss) appears to be an IANA registry-level convention rather than something the RFC states explicitly — a pattern that structurally echoes the later SNMP split of 161 (query) and 162 (trap). SGMP was rapidly superseded by SNMP (RFC 1157) around 1990 and has been Historic for over three decades; no current software implementing SGMP or listening on 160 for this purpose was found. RFC 1028's authentication was plaintext, but with genuine SGMP traffic effectively extinct, a live port 160 today is far more likely to be scanner noise, a honeypot artifact, or an unrelated/misconfigured service than a real SGMP listener.
- IANA assignment
sgmp-traps— "SGMP-TRAPS"; reference (blank — no RFC cited in IANA registry); assignee/contact [Marty_Schoffstahl]; dual-registered 160/tcp + 160/udp, identical [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (cached IANA registry snapshot, lines 397-398); cross-confirmed live at https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no published nmap-services scan-frequency data or typical-host profile found for port 160 in this pass [Unknown]
- Related ports
- 153/tcp,udp (sgmp) — same IANA assignee, the non-trap SGMP port [Confirmed]; structural analogy to the later SNMP 161 (query)/162 (trap) split [Likely, inference not stated in either RFC] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
Primary use
trap/notification side of SGMP (Simple Gateway Monitoring Protocol) — RFC 1028's four message types are Get Request, Get Response, Trap Request, and (optional) Set Request; the RFC's own text names only UDP port 153, so the 160=traps assignment is an IANA registry-level fact, not an RFC-stated one [Confirmed for the registry fact; Likely for the 153/160 split rationale] — https://www.rfc-editor.org/rfc/rfc1028.txt, https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
Other/unofficial uses
none identified [Unknown]
Security implications
SGMP's authentication was plaintext (per RFC 1028's scheme); genuine SGMP traffic is effectively extinct today (superseded by SNMP, RFC 1157, circa 1990), so an open 160 is more likely scanner/honeypot noise than real SGMP. Generic "historically associated with malicious activity" claims on low-quality port-database boilerplate sites were found but carry no specific CVE or malware family and are treated as unverified, not fact [Likely for plaintext-auth characterization; Unknown/Low for the malicious-activity claim] — https://en.wikipedia.org/wiki/Simple_Gateway_Monitoring_Protocol, https://www.rfc-editor.org/rfc/rfc1028.txt
Typically seen on
no published data identified [Unknown]
- Analyst note
- An open TCP/UDP 160 should not be assumed to be genuine SGMP traffic — SGMP has been Historic for three decades with no current implementations found; investigate as scanner/honeypot noise or a misconfigured/unrelated service [Likely]
About port 160/udp.
Port 160/udp is registered with IANA under the service name sgmp-traps, described simply as "SGMP-TRAPS," with Marty Schoffstahl listed as both assignee and contact and no RFC or reference cited in the registry. The entry is dual-registered on TCP and UDP, and the IANA CSV leaves Registration Date, Modification Date, and Reference blank for both rows, so those fields are recorded as unknown rather than guessed. SGMP is the Simple Gateway Monitoring Protocol, an early network-management protocol defined in RFC 1028 (November 1987) that predates SNMP; it split query traffic and trap (notification) traffic onto separate well-known ports, with 153/udp carrying SGMP query/response exchanges and 160/udp carrying unsolicited trap notifications from monitored gateways back to a management station — a pattern IANA later mirrored for SNMP's 161 (query) and 162 (trap) pair. SGMP itself was short-lived: it was effectively superseded by SNMP (RFC 1067) within about a year of its own publication, and SNMP has been the dominant network-management protocol ever since. No modern software implementing SGMP or actively listening on 160/udp was identified, and no verified malware or exposure-scanning association exists for this port; an unexpected response here would be unusual and worth investigating as either legacy equipment or an anomaly rather than a normal finding.
- IANA assignment
sgmp-traps— "SGMP-TRAPS"; reference (blank — no RFC cited in IANA registry); assignee/contact Marty Schoffstahl; dual-registered 160/tcp + 160/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed] — port number range convention
- Registration/modification dates
- blank in the IANA registry for both the tcp and udp rows [Confirmed] — IANA registry CSV
- Prevalence/scanning stats
- nmap-services observed open-frequency 160/udp ≈ 0.000824 — very low (roughly 8 in 10,000 scanned hosts in the nmap-services sample); the paired 160/tcp row carries a frequency of 0 (never observed open in the same sample), consistent with SGMP being a UDP-only protocol [Confirmed for the figures; Likely for the reading] — nmap-services dataset. No separate exposure-scanning telemetry for this port was located in this cycle [Unknown]
- Related ports
- 153/udp (sgmp query/response — the companion channel); 161/udp and 162/udp (SNMP query/trap, the later analogous pair) [Likely] — IANA registry, Wikipedia
Primary use
trap/notification channel for SGMP (Simple Gateway Monitoring Protocol), paired with 153/udp (SGMP query/response); analogous to the later SNMP 161/162 split
Protocol origin
SGMP defined in RFC 1028 (November 1987); effectively superseded by SNMP (RFC 1067) circa 1988. RFC 1028 documents SGMP generally — it is not listed as the IANA "reference" for this port entry, since IANA cites no reference at all
Malware association
no verified malware/trojan association; one low-authority legacy port-lookup site carries a generic, unverified "any port could be repurposed" disclaimer, not treated as a sourced finding
Typically seen on
legacy SGMP-capable gateway monitoring stations (rare); otherwise an anomaly [Likely]
- Current relevance
- obsolete/dormant; SGMP was superseded by SNMP by 1988 and no modern software implementing SGMP or listening on 160/udp was found [Likely] — Wikipedia (Simple Gateway Monitoring Protocol)
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| sgmp-traps | UDP | — | 0.08% |
| sgmp-traps | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.