173

Port 173/tcp is registered with IANA under the service name xyplex-mux, with the description field reading simply "Xyplex" and both the assignee and contact listed as Bob Stewart. The assignment is dual-registered — 173/udp carries the identical service name, description, and contact, with no divergence between the transports. No RFC or other reference document backs the entry; the IANA Reference column is blank, and both the registration-date and modification-date columns are blank as well, so none of those are reported here as if they were known. Historically, xyplex-mux was tied to Xyplex Inc., a maker of serial terminal and console (network access) servers used for out-of-band device management in enterprise and WAN environments during the 1990s. Xyplex was acquired by MRV Communications in 1998 and its product line was later folded into MRV's iTouch Communications division; no evidence points to a modern, actively maintained service binding to this port today, and it reads as a dormant legacy IANA registration rather than a live protocol. Passive-scan telemetry from SANS Internet Storm Center shows only sporadic, low-volume traffic on port 173 with a "green" (no elevated activity) threat rating and no CVEs attached, consistent with routine internet background scanning rather than targeted exploitation. A recurring claim on some low-quality port-lookup aggregator sites that the port has "historically been used by a trojan" is generic boilerplate repeated across many unrelated port pages on those same sites and is not independently corroborated, so it is treated as unverified rather than reported as fact.

IANA assignment

xyplex-mux — description "Xyplex"; assignee/contact [Bob_Stewart]; reference blank; dual-registered 173/tcp + 173/udp with identical fields [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Range class

well-known (0–1023) [Confirmed]

Registration/modification dates

blank in the IANA registry — not fabricated, reported as Unknown [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

IANA reference/RFC

none listed; column is blank, no RFC invented [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Prevalence (open-port frequency)

nmap-services observed open-frequency 173/tcp ≈ 0.000013 — the dataset's lowest nonzero step [Confirmed] — nmap-services dataset; sibling 173/udp ≈ 0.000329, some twenty-five times higher. Both negligible, matching the SANS ISC "sporadic low-volume" picture

Related ports

173/udp — the same xyplex-mux registration, dual-registered by IANA with an identical description ("Xyplex") and the same assignee/contact [Bob_Stewart]; a service-name and assignee search of the cached registry returns these two rows and no others, so 173/udp is the only port related to this one by registration

[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry xyplex-mux 173/udp

Exposure/scanning posture

SANS ISC reports only sporadic low-volume scan activity, threat level "green," no CVEs tied to the port

Malware associations

an unsourced "used by a trojan" claim appears only as generic template text on low-quality port-lookup aggregator sites; not independently corroborated, treated as Unknown

Typically seen on

legacy/decommissioned Xyplex or MRV/iTouch console-server hardware, if seen at all; otherwise unexpected/anomalous [Likely]

Primary/historical use

multiplexed management protocol for Xyplex terminal/console (network access) servers, a 1990s enterprise out-of-band device-management product line [Likely] — https://en.wikipedia.org/wiki/MRV_Communications ; https://conserver.com/consoles/Xyplex/xyplexcons.html

Vendor history

Xyplex acquired by MRV Communications (1998), later folded into MRV's iTouch Communications division; no current mainstream software documented as using this port [Likely] — https://en.wikipedia.org/wiki/MRV_Communications ; https://www.sec.gov/Archives/edgar/data/0000887969/000095014801502654/v76157a4posam.txt

Port 173/udp is registered with IANA under the service name xyplex-mux, description "Xyplex," with both the assignee and contact fields listing [Bob_Stewart]. The registration is dual — the same name, description, and contact also cover 173/tcp — and, like many assignments from this era of the registry, the Reference, Registration Date, and Modification Date fields are blank rather than populated, so no RFC and no assignment date can honestly be cited for this port; those fields are recorded here as null rather than guessed. The name traces to Xyplex, a vendor of terminal and console-server hardware — serial-console-over-Ethernet access devices — that was prominent in the 1990s and was later absorbed into MRV Communications' NBase-Xyplex product lines; no public specification of the xyplex-mux wire protocol itself was located, so what the multiplexer actually does on the wire is not documented anywhere accessible. No current (post-2010) software, vendor documentation, CVEs, or malware/trojan-port associations were found tied to UDP/173; GRC's Port Authority listing only echoes the bare IANA name without security annotation. Practically, this is a legacy, low-visibility assignment: a live host answering on 173/udp today would most plausibly be either surviving Xyplex/NBase-Xyplex console-server hardware or an unrelated/incidental listener, not a widely deployed service.

IANA assignment

xyplex-mux — "Xyplex"; assignee/contact [Bob_Stewart]; dual-registered 173/tcp + 173/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 431-432); cross-checked against https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Registration/modification dates

blank in the IANA registry (legacy pre-2000-era assignment) [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023)

Primary use

historically associated with Xyplex terminal/console-server hardware (serial-console-over-Ethernet access devices, 1990s vintage; vendor later folded into MRV Communications / NBase-Xyplex); no public wire-protocol spec found [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt, https://conserver.com/consoles/Xyplex/xyplexcons.html

Common software today

Unknown — no current (post-2010) software or vendor documentation binding to this port was found; associated hardware line is legacy/EOL [Unknown]

Security implications / exposure notes

Unknown — no CVEs, malware/trojan-port associations, or scan-telemetry writeups specific to UDP/173 were found; GRC Port Authority lists only the bare IANA name with no security annotation

Typically seen on

legacy Xyplex/NBase-Xyplex console-server hardware, if present at all; otherwise incidental/unexplained

Reference (RFC/doc)

blank in the IANA registry — no RFC or reference exists, not fabricated [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Analyst note

a responsive UDP/173 today is uncommon and most plausibly legacy console-server hardware rather than an active modern service; treat as low-prevalence and investigate context before assuming malicious intent.