168
Summary
- // if you see it open
- No CVE, malware family, or botnet is documented against this port. No exposure/Shodan statistics were located in this research pass. Because no legitimate protocol is defined, an open 168/tcp should be treated as anomalous or unidentified and fingerprinted rather than assumed to be any known service.
- // analyst note
- With no defined protocol and negligible empirical prevalence, an open 168/tcp warrants fingerprinting the actual response rather than assuming any documented service.
About port 168/tcp.
Port 168/tcp is registered with IANA as rsvd, described simply as "RSVD," with Alan Sandell listed as both assignee and contact, a blank registration date, a modification date of 2008-05-01, and a blank reference field; it is dual-registered identically on 168/udp, with both entries carrying the same service name, description, assignee/contact, and dates. Unlike most well-known-range entries, rsvd has no associated RFC, protocol specification, or documented service behind it — the name itself reads as shorthand for "reserved," and IANA's own registry offers no reference to a defining document, so there is nothing to point to as the "actual protocol" running on the port. No software, appliance, or product has been found publicly associated with either 168/tcp or 168/udp, and no CVE, malware family, or botnet is documented against the port in any source checked. Empirically the port is almost never seen open: Nmap's canonical nmap-services frequency file records 168/tcp at roughly 0.000013 and 168/udp at roughly 0.000412 — both negligible fractions of scanned hosts, consistent with a reserved-but-unused assignment rather than an active service. Because there is no legitimate protocol to expect, an open 168/tcp in a scan should not be assumed to be any known service; the safest analyst posture is to treat it as anomalous or unidentified, fingerprint the actual banner/response, and file it alongside other IANA placeholder "reserved" registrations rather than a functioning application port.
- IANA assignment
rsvd— "RSVD"; reference (blank — no RFC cited in IANA registry); assignee/contact Alan Sandell; dual-registered 168/tcp + 168/udp [Confirmed] — cached IANA CSV (the IANA Service Name and Transport Protocol Port Number Registry, lines 413–414) and live IANA registry text agree- Registration date
- blank in the source registry, left blank (not fabricated) [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
- Modification date
- 2008-05-01 — IANA's own registry modification/contact-update timestamp, not an original-assignment date [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 168/tcp ≈ 0.000013, 168/udp ≈ 0.000412 (negligible) [Confirmed] — https://svn.nmap.org/nmap/nmap-services
- Related ports
- 168/udp (identical dual-registered
rsvdsibling) [Confirmed]
Primary use
none defined; rsvd is a reserved/placeholder entry with no protocol spec, RFC, or documented service behind it [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt (absence of a reference field, corroborated by no independent protocol documentation found)
Common software
Unknown / none identified — targeted searches (including for a hypothesized "MSI" association) found no software, appliance, or product tied to this port [Unknown]
Security implications
no CVE, malware, or botnet association found; no exposure/Shodan statistics located for this pass [Unknown]
Typically seen on
none identified; an open 168 should be treated as anomalous/unidentified rather than assumed to be a known service
- Analyst note
- With no defined protocol and negligible empirical prevalence, an open 168/tcp warrants fingerprinting the actual response rather than assuming any documented service.
About port 168/udp.
Port 168/udp is registered with IANA under the service name rsvd, with the description field containing only the bare acronym "RSVD" — no expanded name, no linked RFC, and no functional description are published anywhere in the registry. The assignee is listed as Alan Sandell, and the entry's most recent IANA modification date is 2008-05-01; the Registration Date and Reference columns are both blank in the source data, so those fields are recorded here as null rather than guessed. The identical entry is dual-registered on 168/tcp with the same service name, description, assignee, and modification date, and an equally blank reference. Neither IANA's own registry nor independent web research turned up a protocol specification, a piece of software known to bind to this port, or any documented real-world usage — "RSVD" is never expanded in any primary source, so its literal meaning is unverifiable. One naming trap is worth flagging for anyone touching this entry: Microsoft's "RSVD" (MS-RSVD, the Remote Shared Virtual Disk Protocol used by Storage Spaces Direct and Scale-Out File Server) shares the acronym but is unrelated — it rides over SMB 3.0.2/3.1.1, not a dedicated listener on port 168. No malware or trojan is confirmed to use this port; a third-party port-lookup site's "No" virus designation is boilerplate template text repeated across its port pages, not port-168-specific threat intelligence. No exposure or internet-scanning prevalence data exists for this port in the sources checked.
- IANA assignment
- service name
rsvd; description "RSVD" (bare acronym only, no expansion); assignee Alan Sandell; modification date 2008-05-01; Registration Date and Reference columns blank [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt - Range class
- well-known (0–1023) [Confirmed]
- Dual registration
- identical entry at 168/tcp (same service name, description, assignee, dates; reference also blank) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
Primary use
Unknown/undocumented — IANA publishes no expansion or spec beyond the acronym "RSVD"; no independent technical documentation or known real-world software binding to this port was found
Common software
none identified in this research pass [Unknown]
Malware/trojan association
none confirmed; a third-party port-lookup page shows a generic "No" virus/trojan designation with boilerplate disclaimer text repeated across all its port pages, not port-168-specific intelligence
Exposure/scanning prevalence
no port-168-specific scanning or exposure data found; treat any claim of routine internet-wide scanning as unverified [Unknown]
- Naming collision
- Microsoft's MS-RSVD (Remote Shared Virtual Disk Protocol, used by Storage Spaces Direct / Scale-Out File Server) shares the acronym but is a distinct, unrelated protocol transported over SMB 3.0.2/3.1.1, not a dedicated 168 listener[Confirmed] — https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rsvd/c865c326-47d6-4a91-a62d-0e8f26007d15
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| rsvd | UDP | — | 0.04% |
| rsvd | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.