165

Port 165/tcp is registered with IANA as xns-courier, described simply as "Xerox," with assignee and contact both listed as Susie_Armstrong_2. The Registration Date, Modification Date, and Reference (RFC) columns are blank in the IANA registry — a common pattern for legacy assignments predating the modern registration-request process, so no date or RFC number is fabricated here; the blanks are recorded as-is. Port 165/udp carries an identical dual-registration (same service name, description, and contact fields), a pairing typical of Xerox Network Systems (XNS)-era port grants. xns-courier refers to the XNS Courier protocol, a remote procedure call (RPC) mechanism from Xerox's early-1980s XNS networking suite, modeled on Mesa-language function calls and used to carry higher-level Xerox application protocols — remote printing, filing, and mailing — between Xerox workstations and servers such as the Xerox Star/8010 line and later third-party XNS stacks (including early Sun and 3Com implementations). XNS predates, and directly influenced, parts of Novell's IPX/SPX and early Banyan VINES networking stacks. The protocol is effectively obsolete today: this research pass found no CVEs, no malware families, and no actively maintained modern software binding to port 165, and no scan-prevalence telemetry (Shodan, Censys, or nmap-services frequency data) specific to this port turned up either. A responsive port 165 on a contemporary host would be anomalous and worth flagging as a legacy relic, a decoy, or a misconfigured service rather than expected, benign traffic.

IANA assignment

xns-courier — "Xerox"; reference (blank — no RFC cited in IANA registry); assignee/contact Susie_Armstrong_2; dual-registered 165/tcp + 165/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-408; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023) [Confirmed]

Registration/modification dates

blank in the IANA registry (not fabricated) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Prevalence

no dated, port-specific scan-frequency data (Shodan/Censys/nmap-services) located in this pass [Unknown] — no citation found

Related ports

the closest XNS-suite IANA sibling is xns-ch (XNS Clearinghouse) at port 54/tcp+udp (registry rows 116-117); note that port 166 is NOT an XNS service — the registry assigns 166 to s-net "Sirius Systems" [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-117, :409-410

Primary use

XNS Courier — an RPC protocol from Xerox Network Systems, modeled on Mesa-language function calls, used historically to carry Xerox application protocols (remote printing, filing, mailing) [Confirmed] — https://en.wikipedia.org/wiki/Xerox_Network_Systems; https://www.iana.org/assignments/xns-protocol-types/xns-protocol-types.xhtml

Other/unofficial uses

none found beyond the historical Xerox-XNS ecosystem (Xerox Star/8010, early Sun/3Com XNS stacks)

Security implications

legacy, effectively obsolete protocol; no CVEs or modern security advisories specific to xns-courier/port 165 found; an open port 165 today would be anomalous rather than expected [Unknown/neutral — absence of findings, not a confirmed clean bill]

Typically seen on

historical Xerox XNS-based workstations/servers (1980s–90s); otherwise unexpected on modern hosts

Analyst note

A responsive port 165 in a current-day scan is unusual — treat as a legacy relic, decoy, or misconfiguration rather than expected traffic; no evidence found of active exploitation or malware tied specifically to this port.

Port 165/udp is registered with IANA as xns-courier, described simply as "Xerox," with assignee and contact both listed as Susie Armstrong; the Registration Date, Modification Date, IANA Reference, Service Code, Unauthorized Use Reported, and Assignment Notes columns are all genuinely blank in the registry, and no RFC governs the assignment. IANA registers 165/tcp under the identical service name and organization, with the same assignee/contact and every other column equally blank, so this is a same-name dual TCP/UDP registration rather than a UDP-specific one. The registry text itself carries no protocol description; per secondary technical and archival sources (Wikipedia, Xerox's own XNS architecture manual hosted on bitsavers, and a third-party networking-technology overview), "Courier" was the remote-procedure-call (RPC) protocol used inside Xerox Network Systems (XNS), the proprietary internetworking suite Xerox built at PARC in the early 1980s on top of the earlier PUP (PARC Universal Packet) protocol family. Courier carried the RPC calls used by higher-level XNS applications — remote filing, printing, and mailing — on Xerox workstations such as the Star. XNS predates and influenced later internetworking concepts but was effectively displaced by TCP/IP (and, on LANs, by IPX, which borrowed XNS concepts) by the 1990s. No actively maintained software implementing xns-courier as a live network service was found in research, and no port-165-specific honeypot or Shodan/Censys exposure data turned up despite targeted searches — though the nmap-services dataset does record an observed open-frequency for 165/udp of ≈ 0.000379 (very low, roughly 4 in 10,000 scanned hosts), against 0 for the paired 165/tcp row. Any modern traffic seen on 165/udp is more plausibly scanner noise or unrelated activity than genuine Courier/XNS traffic, though that specific claim is unverified and should not be asserted as fact.

IANA assignment

xns-courier — "Xerox"; reference blank (no RFC cited); assignee/contact [Susie_Armstrong_2]; also registered as 165/tcp under the same name/org, same assignee/contact, all other columns blank [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (row 407 for the tcp counterpart), corroborated by live IANA registry fetch

Registration Date / Modification Date / Service Code / Unauthorized Use Reported / Assignment Notes

blank in the source registry — reported as null, not fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed]

Prevalence (nmap-services open frequency)

nmap-services observed open-frequency 165/udp ≈ 0.000379 — very low (roughly 4 in 10,000 scanned hosts in the nmap-services sample); the paired 165/tcp row carries a frequency of 0 (never observed open in the same sample) [Confirmed] — nmap-services dataset

Related ports

Unknown / none independently verified this cycle [Unknown]

Primary use

Courier — the RPC protocol used within Xerox Network Systems (XNS), Xerox's early-1980s proprietary networking suite built on the earlier PUP (PARC Universal Packet) family; carried RPC calls for higher-level XNS services (filing, printing, mailing) [Likely — protocol description is from secondary/archival sources, not the IANA registry itself] — https://en.wikipedia.org/wiki/Xerox_Network_Systems, http://www.bitsavers.org/pdf/xerox/xns/XNSG_068504_Xerox_System_Network_Architecture_General_Information_Manual_Apr85.pdf, https://www.filibeto.org/sun/lib/networking/internetworking_technology_overview/Xerox_Network_Systems_(XNS).pdf

Exposure/scanning notes

beyond the nmap-services open-frequency recorded below (≈ 0.000379, very low), no port-165-specific honeypot or Shodan/Censys exposure data was found despite targeted searches; XNS/Courier is functionally obsolete so genuine modern use is considered unlikely but unconfirmed

Common implementations

Unknown — no actively maintained modern software found implementing xns-courier as a live service; historically associated with 1980s-era Xerox workstations (e.g., Xerox Star) [Unknown] — https://en.wikipedia.org/wiki/Xerox_Network_Systems