175
Summary
- // if you see it open
- No known malware, trojan, or CVE association found for port 175. SANS ISC rates it 'green' (low threat) with only incidental background-scan traffic; not listed on Gary Kessler's bad-ports reference. A generic 'flagged as virus' claim on low-quality aggregator sites is unverified boilerplate repeated across many unrelated ports.
About port 175/tcp.
Port 175/tcp is registered with IANA under the service name vmnet, description "VMNET," with assignee and contact both listed as [Christopher_Tengi] (Princeton University). The registration is dual — 175/udp carries an identical entry — and the Registration Date, Modification Date, Reference, Service Code, and Assignment Notes columns are all blank in the current IANA registry; those blanks are reported honestly here rather than filled with an invented date or RFC. The same vmnet/175 assignment, with contact Christopher Tengi's Princeton address, already appears verbatim in RFC 1700, "Assigned Numbers" (October 1994), so the reservation has existed at least since then — but RFC 1700 is a historic snapshot of the assigned-numbers list, not a protocol specification, and it is not cited by the current registry as this entry's formal Reference, so it is noted only as corroborating history, not recorded as an IANA reference. No protocol specification, vendor documentation, or product describing a wire protocol named "VMNET" bound to port 175 was located; this reservation predates, and is unrelated to, VMware Inc.'s later "VMnet" virtual network interfaces (bridged/NAT/host-only), which use different, unrelated ports — the name overlap is coincidental. Consistent with a dormant legacy reservation, nmap's scan-derived frequency data shows 175/tcp essentially never observed open (0.000000) and 175/udp only marginally more so (0.000379). SANS Internet Storm Center currently rates port 175 "green" (low/no elevated threat), no CVE is tied to it, and it does not appear on Gary Kessler's widely used bad-ports reference; a generic "flagged as virus/Trojan" disclaimer on low-quality aggregator sites repeats across many unrelated ports and is treated as unverified boilerplate, not fact.
- IANA assignment
vmnet— description "VMNET"; assignee/contact[Christopher_Tengi]; dual-registered 175/tcp + 175/udp with identical registry content [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml- IANA Reference field
- blank — no RFC or other formal specification is cited for this assignment [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
- Registration/modification dates
- blank in the IANA registry; not recorded, reported as Unknown rather than fabricated [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 175/tcp = 0.000000 (statistically unobserved); 175/udp = 0.000379 (very low) [Confirmed] — https://svn.nmap.org/nmap/nmap-services
- Related ports
- adjacent legacy IANA reservations 174/tcp+udp and 177/tcp+udp exist in the same registry neighborhood, but no direct protocol relationship to vmnet/175 was found [Unknown]
Primary use
registered IANA name only ("vmnet"/VMNET); no defined wire protocol, vendor documentation, or software describing an actual VMNET service on this port was found
Security implications / known malware or CVE
SANS ISC shows a "green" low-threat rating with only sporadic background-scan traffic; no CVE found; not listed on Gary Kessler's bad-ports reference; an unverified generic "virus" disclaimer on aggregator sites (e.g. auditmypc.com) is repeated across many unrelated ports and is not treated as fact
Typically seen on
no confirmed deployments identified; an actively responding service on port 175 would be unusual and worth treating as an anomaly [Unknown]
- Historical documentation
- the identical vmnet/175 tcp+udp assignment (contact Christopher Tengi, Princeton University) appears in RFC 1700 "Assigned Numbers" (October 1994), evidencing the reservation existed by 1994; RFC 1700 is a historic snapshot, not a protocol spec, and is not the registry's cited Reference[Confirmed] — https://www.rfc-editor.org/rfc/rfc1700.txt
- Relationship to VMware "VMnet"
- name-only coincidence; this IANA reservation predates and is unrelated to VMware Inc.'s virtual network interfaces, which use different ports [Likely] — https://www.connected.app/el/ports/175
About port 175/udp.
Port 175/udp is registered with IANA as vmnet, description "VMNET," assignee/contact Christopher J. Tengi of Princeton University. The registry entry is thin: the Registration Date, Modification Date, and IANA Reference (RFC) fields are all blank in both the cached registry CSV and the live IANA XML/TXT registry, so no RFC or assignment date can be cited — these are left as Unknown rather than invented. Port 175 is dual-registered: 175/tcp carries the identical service name, description, and assignee, indicating the pair was reserved together in the well-known range (0–1023). The name "vmnet" invites an assumption of a link to VMware's VMnet virtual networking technology, but no primary source ties the IANA port-175 assignment to VMware — VMware's vmnet operates at the hypervisor/virtual-interface layer and is not documented as using a network-visible port 175, and the only source raising the connection explicitly treats it as a probable coincidence rather than a confirmed relationship. No mainstream, currently maintained software was found to actively bind a live service to this port. No malware, trojan, or CVE association was found in the sources checked; one consumer port-lookup source explicitly notes no virus/trojan flag for the port, though such flags are self-reported and not exhaustive. Overall this is an obscure, essentially unused well-known-range port with a genuine but sparse IANA record.
- IANA assignment
vmnet— "VMNET"; reference (blank — no RFC cited in IANA registry); assignee/contact Christopher J. Tengi (Princeton University) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml) and cached registry CSV (the IANA Service Name and Transport Protocol Port Number Registry, line 436)- Registration/Modification date
- not present in the IANA registry entry — left blank/Unknown, not inferred [Confirmed — absence verified] — IANA registry (as above)
- Range class
- well-known (0–1023) [Confirmed] — IANA registry
- Dual registration
- 175/tcp carries the identical service name, description, and assignee/contact (registered as a tcp/udp pair) [Confirmed] — IANA registry; cached CSV line 435 (175/tcp) vs line 436 (175/udp)
- Prevalence
- very low / effectively unused in modern networks [Likely, single source] — https://www.connected.app/el/ports/175
- Related ports
- 175/tcp (identical dual registration: same service name, description, assignee, contact) [Confirmed] — IANA registry
Primary use
no confirmed active service; the IANA name "vmnet" is not documented as related to VMware's VMnet virtual-networking technology — the shared name is most likely coincidental per a secondary source, not a primary confirmation
Other/unofficial uses
none documented; nmap-services lists the port under the same "vmnet" name, but that is a downstream copy of the IANA assignment, not independent evidence of active use
Security implications
no confirmed virus/trojan/malware association found; one consumer lookup source explicitly flags "Virus/Trojan: No" for this port
Typically seen on
no known legitimate deployment; an open/responsive 175/udp would be anomalous and worth investigating as custom/internal use or misconfiguration rather than assumed standard service [Likely — inference from absence of documented use]
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| vmnet | UDP | — | 0.04% |
| vmnet | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.