163
Summary
- // if you see it open
- No CVEs or known-exploited entries specific to cmip-man/port 163 identified in this pass. CMOT is largely obsolete (superseded by SNMP by the early 1990s), so an unexpected open port 163 on a host with no CMOT role is more likely a misconfigured legacy stack, a repurposed/mislabeled listener, or a decoy than genuine traffic.
- // analyst note
- given CMOT's obsolescence, a responsive port 163 is statistically rare on modern hosts and warrants investigation as an anomaly rather than expected traffic [Likely] — reasoning based on protocol adoption history (RFC 1189 vs. SNMP's dominance).
About port 163/tcp.
Port 163/tcp is registered with IANA as cmip-man, description "CMIP/TCP Manager," with the Assignee, Contact, Registration Date, Modification Date, and Reference columns all blank in the registry — a pattern typical of the earliest (pre-1994) IANA port assignments, which predate the registry's contact-tracking fields, rather than a data-quality gap. The assignment is dual-registered identically on 163/udp. "cmip-man" is the manager side of CMOT — CMIP over TCP/IP — a late-1980s/early-1990s effort, specified in RFC 1189 (1990, itself a revision of RFC 1095, 1989), to run the OSI Common Management Information Protocol over the Internet protocol suite as a rival to SNMP for network management. Its companion is 164/tcp, cmip-agent, the agent side of the same manager/agent pairing convention. CMOT lost the network-management standards contest to SNMP by the early 1990s, and no actively maintained software implementing cmip-man on port 163 was identified in this pass; some legacy OSI-management stacks (e.g., ISODE-derived tooling) implemented CMIP-family protocols historically. The nmap-services dataset records an observed open-frequency of roughly 0.000590 for 163/tcp and 0.000840 for 163/udp — very low on either transport — and no port-163-specific malware association or CVE was found. Because the protocol is effectively obsolete, a responsive port 163 today is unusual and worth treating as an anomaly — a stale legacy stack, a mislabeled service reusing a well-known number, or a decoy — rather than expected traffic.
- IANA assignment
cmip-man— "CMIP/TCP Manager"; Assignee/Contact/Registration Date/Modification Date/Reference all blank in registry; dual-registered 163/tcp + 163/udp [Confirmed] — file:the IANA Service Name and Transport Protocol Port Number Registry#L403 (see also #L404); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 163/tcp ≈ 0.000590 (very low — roughly 6 in 10,000 scanned hosts in the nmap-services sample) [Confirmed] — nmap-services dataset; the dual-registered 163/udp side is somewhat higher at ≈ 0.000840[Confirmed] — nmap-services dataset. No Shodan/Censys-style dated exposure statistic was found for this port in this pass [Unknown]
- Related ports
- 164/tcp
cmip-agent— the agent side of the same manager/agent protocol pairing [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml
Primary use
manager side of CMOT (CMIP over TCP/IP), an OSI-derived network-management protocol positioned as an SNMP alternative; specified in RFC 1189 (1990), revising RFC 1095 (1989)
Other/unofficial uses
none verified in this research pass [Unknown]
Security implications
no CVEs or known-exploited-vulnerability entries specific to cmip-man/port 163 identified; because CMOT is largely obsolete, an unexpected open 163 on a host with no CMOT role is more likely a misconfigured legacy stack, a repurposed/mislabeled listener, or a decoy than a genuine management service
Typically seen on
legacy/historical OSI network-management stacks (e.g., ISODE-based tooling); not observed as an actively deployed service today [Unknown]
- Analyst note
- given CMOT's obsolescence, a responsive port 163 is statistically rare on modern hosts and warrants investigation as an anomaly rather than expected traffic [Likely] — reasoning based on protocol adoption history (RFC 1189 vs. SNMP's dominance).
About port 163/udp.
Port 163/udp is registered with IANA under the service name cmip-man, described as "CMIP/TCP Manager"; the identical name and description are also registered for 163/tcp, and both entries show blank Assignee, Contact, and Reference fields in the current IANA Service Name and Transport Protocol Port Number Registry. CMIP (Common Management Information Protocol) is the OSI stack's network-management protocol; "CMIP/TCP" — sometimes called CMOT (CMIP Over TCP/IP) — was a late-1980s/early-1990s effort to run CMIP-style management over the TCP/IP stack rather than the full OSI protocol suite, positioned as an alternative to the emerging SNMP. Port 163 is the "Manager" side of a manager/agent pair; the paired "Agent" role, cmip-agent ("CMIP/TCP Agent"), sits on the adjacent port 164 (also registered for both tcp and udp). No RFC or other reference document is cited for either the manager or agent entries in the IANA registry, so the Reference field is correctly left blank rather than invented. CMIP/CMOT was largely superseded by SNMP by the mid-1990s, and no actively maintained software, CVEs, malware family, or internet-scanning writeup tied specifically to port 163 turned up in this pass; it functions today essentially as a legacy/historical registry entry rather than a live, commonly deployed service, so a responsive UDP/163 in a scan is more plausibly routine broad-range port probing than an actual CMIP manager in use.
- IANA assignment
cmip-man— "CMIP/TCP Manager"; reference (blank — no RFC cited); assignee/contact blank; dual-registered 163/tcp + 163/udp [Confirmed] — local registry CSV (line 404) and IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 163/udp ≈ 0.00084 — very low (roughly 8 in 10,000 scanned hosts in the nmap-services sample); the paired 163/tcp row is comparable at ≈ 0.00059, so neither transport shows meaningful deployment [Confirmed] — nmap-services dataset
- Related ports
- 164/tcp + 164/udp — registered as
cmip-agent, "CMIP/TCP Agent" [Confirmed — adjacent IANA registry entry]; the manager/agent pairing between 163 and 164 is a reasonable inference from naming and adjacency rather than an explicit registry statement [Likely]
Primary use
CMIP-over-TCP/IP ("CMOT") network management — the "Manager" role in a manager/agent scheme, an early alternative to SNMP [Likely — historical framing inferred from the registry name/description, not spelled out by IANA] — IANA registry
Other/unofficial uses
Unknown — no current, actively-maintained software implementing cmip-man on port 163 was found; the assignment reads as a legacy/historical registry entry [Unknown]
Security implications
Unknown — no CVEs, malware families, or exposure/scanning writeups specific to port 163 were found; unsolicited UDP/163 traffic is more plausibly routine broad-range port scanning than an active CMIP deployment, but that is inference, not an independently sourced claim [Unknown]
Typically seen on
Unknown — no current active deployments identified; historically, OSI/CMIP-era network-management hosts only [Unknown]
- Analyst note
- Treat port 163 as an obsolete/rarely-deployed CMIP-management assignment; a live response is unusual and worth noting as anomalous rather than assuming an active CMIP manager.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| cmip-man | UDP | CMIP/TCP Manager | 0.08% |
| cmip-man | TCP | CMIP/TCP Manager | 0.06% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.