17
Summary
- // if you see it open
- 17/udp is an established UDP amplification/reflection DDoS vector — US-CERT TA14-017A lists QOTD with a bandwidth amplification factor of ~140.3x (small spoofed 'quote request' elicits a much larger response at the victim). National CSIRTs (e.g. Ireland's NCSC) and Shadowserver run open-QOTD scanning; Nessus plugin 10198 detects it. TCP qotd is NOT a reflection vector (handshake required). Disable as part of small-services hardening.
- // analyst note
- An open 17/udp is a DDoS-reflector liability; close it. 17/tcp is benign legacy but should also be disabled.
About port 17/tcp.
Port 17/tcp is registered with IANA as qotd with the description "Quote of the Day," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP). The Quote of the Day protocol, defined in RFC 865 (Postel, May 1983), returns a short quotation — the RFC recommends keeping it under 512 characters — and ignores any input: on TCP the server sends the quote and closes, and on UDP it answers each datagram with a quote datagram. It was a whimsical early-Internet utility, the kind of "small service" bundled into inetd alongside echo, discard, daytime, and chargen. The IANA reference field is blank. The security relevance is on the UDP side: 17/udp is an established amplification/reflection DDoS vector. US-CERT/CISA Alert TA14-017A ("UDP-Based Amplification Attacks") tabulates QOTD with a bandwidth amplification factor of roughly 140.3x — meaning a small spoofed "quote request" elicits a much larger response aimed at the victim — and national CSIRTs (such as Ireland's NCSC) and Shadowserver run open-QOTD scanning and notification projects, while Nessus plugin 10198 detects the service. The TCP QOTD service is not a reflection vector, since TCP's handshake prevents the source-address spoofing that reflection relies on. As with the rest of the small services, modern guidance and defaults are to disable QOTD. For an analyst, an open 17/udp is a DDoS-reflector liability that should be closed; 17/tcp is benign legacy but should likewise be disabled.
- IANA assignment
qotd— "Quote of the Day"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 17/tcp + 17/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 17/tcp ≈ 0.002346; 17/udp ≈ 0.009209 (de-facto) [Well-established] — nmap-services file
- Related ports
- 19 (chargen, 358.8x), 7 (echo), 13 (daytime), 9 (discard); 17/udp sibling
Primary use
return a short quotation (RFC 865)
Other/unofficial uses
legacy novelty/diagnostic service [Well-established]
Security implications
17/udp is a UDP amplification/reflection DDoS vector (US-CERT TA14-017A bandwidth amplification factor ~140.3x); open-QOTD scanning by CSIRTs/Shadowserver; Nessus plugin 10198; TCP qotd is NOT a reflection vector (handshake required); disable as part of small-services hardening
Typically seen on
legacy Unix, small-services-enabled devices
- Analyst note
- An open 17/udp is a DDoS-reflector liability; close it. 17/tcp is benign legacy but should also be disabled.
About port 17/udp.
Port 17/udp is registered with IANA as qotd with the description "Quote of the Day," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP). The Quote of the Day protocol is defined in RFC 865 (Postel, May 1983); on UDP the server ignores the contents of any inbound datagram and answers it with a single datagram containing a short ASCII quotation, which the RFC recommends keeping under 512 characters. It was one of the whimsical early-Internet "small services" bundled into inetd alongside echo, discard, daytime, and chargen, and like the rest it is disabled by default on modern operating systems and effectively obsolete as a legitimate service. The reason 17/udp matters to an analyst is not the quotes — it is that the connectionless, input-ignoring "answer any datagram with a larger reply" design makes it a textbook reflection/amplification DDoS vector. Because UDP has no handshake, an attacker can spoof the victim's source address so the amplified replies land on the victim; US-CERT/CISA Alert TA14-017A ("UDP-Based Amplification Attacks") tabulates QOTD with a bandwidth amplification factor of roughly 140.3x, and national CSIRTs (such as Ireland's NCSC) and the Shadowserver Foundation run open-QOTD scanning and notification projects that probe UDP/17 and report exposed hosts to network owners. The corresponding TCP service (17/tcp) is not a reflection vector, since TCP's handshake prevents the source-address spoofing reflection relies on — which is exactly why the risk is concentrated on the UDP side. For an analyst, an open 17/udp is a DDoS-reflector liability that should be closed: disable the QOTD service and block inbound and outbound UDP port 17 at the firewall, and apply ingress/egress filtering to defeat the spoofing the attack depends on.
- IANA assignment
qotd— "Quote of the Day"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 17/tcp + 17/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 39); corroborated by RFC 865 https://www.rfc-editor.org/rfc/rfc865.html- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 17/udp ≈ 0.009209 (de-facto); 17/tcp ≈ 0.002346 [Likely] — nmap-services file (https://nmap.org/book/nmap-services.html); single-source de-facto measurement
- IANA registration / modification date
- Unknown (blank in the IANA registry — not published; no fabrication) [Unknown]
- Related ports
- 19 (chargen, ~358.8x), 7 (echo), 13 (daytime), 9 (discard); 17/tcp sibling
Primary use
answer each inbound UDP datagram with a short quotation (≤512 chars recommended), ignoring the request contents (RFC 865)
Other/unofficial uses
legacy novelty/diagnostic "small service"; historically shipped as an optional Windows "Simple TCP/IP Services" component and as an inetd/xinetd service on Unix/Linux, disabled by default on modern OS releases
Security implications
17/udp is an established UDP amplification/reflection DDoS vector — US-CERT/CISA Alert TA14-017A lists QOTD with a bandwidth amplification factor of ~140.3x (a small spoofed "quote request" elicits a much larger response at the victim); open-QOTD scanning by national CSIRTs (e.g. Ireland's NCSC) and the Shadowserver Foundation (MEDIUM severity); the TCP qotd service is NOT a reflection vector (handshake required); disable as part of small-services hardening [Confirmed] — https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks, https://www.ncsc.gov.ie/emailsfrom/reports/ddos/qotd/, https://www.shadowserver.org/what-we-do/network-reporting/open-qotd-report/
Typically seen on
legacy Unix hosts, small-services-enabled devices and embedded systems exposed to the internet
- Amplification factor
- ~140.3x maximum BAF [Confirmed] — corroborated by US-CERT TA14-017A, NCSC Ireland, and INCIBE-CERT (https://www.ncsc.gov.ie/emailsfrom/reports/ddos/qotd/, https://www.incibe.es/en/incibe-cert/blog/drdos-cyberattacks-based-qotd-protocol)
- Analyst note
- An open 17/udp is a DDoS-reflector liability — close it (disable QOTD, block UDP/17, apply anti-spoofing ingress/egress filtering). The 17/tcp sibling is benign legacy but should also be disabled.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| qotd | UDP | Quote of the Day | 0.92% |
| qotd | TCP | Quote of the Day | 0.23% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.