179
Summary
- // if you see it open
- BGP cannot inherently verify which AS may originate a prefix, enabling hijacks/route leaks. Incidents: Pakistan Telecom/YouTube (24 Feb 2008, ~2h global blackhole via a more-specific /24 propagated by PCCW, per RIPE RIS); MyEtherWallet/Amazon Route 53 (April 2018, DNS-prefix hijack, ~$150K crypto stolen); Facebook (4 Oct 2021, ~6h self-inflicted outage from withdrawing its own BGP routes/DNS during a backbone error). Mitigations: TCP-MD5 (RFC 2385), TCP-AO (RFC 5925), GTSM (RFC 5082), RPKI/ROA/ROV (RFC 6480+), RFC 7454, max-prefix limits, prefix filtering.
- // common applications
- Cisco IOS BGPJuniper JunosBIRDFRRoutingExaBGP
- // analyst note
- An open 179 is a BGP router/peering device; ACL it to known peers only, protect with TCP-AO/MD5 + GTSM, and never leave it openly reachable. Unexpected 179 on a non-router host warrants investigation.
About port 179/tcp.
Port 179/tcp is registered with IANA as bgp with the description "Border Gateway Protocol," assignee Kirk Lougheed, and a blank reference field; the registry also carries a separate 179/sctp "BGP" row (assignee Randall Stewart, reference [RFC9260], modified 2022-02-07). BGP is the inter-domain routing protocol that makes the global internet's routing work, exchanging network reachability between autonomous systems. BGP-4 is defined in RFC 4271 (January 2006, Rekhter, Li, and Hares), which obsoletes RFC 1771: it is a path-vector protocol in which a speaker advertises IP prefixes to peers along with the AS_PATH and other attributes so loops can be pruned and policy applied, it supports CIDR and aggregation, and its sessions are long-lived TCP connections to port 179 between explicitly configured neighbors, with UPDATE messages carrying prefix announcements and withdrawals. The IANA reference field for the TCP row is blank. BGP's core weakness is that it cannot inherently verify which AS is legitimately permitted to originate a prefix — it largely assumes peers tell the truth — and this has produced famous incidents: the Pakistan Telecom / YouTube hijack of 24 February 2008 (a more-specific 208.65.153.0/24 announcement propagated by upstream PCCW blackholed YouTube globally for roughly two hours, per RIPE NCC's RIS analysis); the April 2018 MyEtherWallet / Amazon Route 53 hijack, where attackers announced Amazon DNS prefixes to redirect users to a fake site and steal on the order of $150,000 in cryptocurrency; and Facebook's 4 October 2021 outage, a roughly six-hour self-inflicted global outage caused by Facebook withdrawing its own BGP routes (and with them its authoritative DNS) during a backbone maintenance error. Mitigations include session integrity via TCP-MD5 (RFC 2385) and the modern TCP-AO (RFC 5925), the GTSM TTL-security hack (RFC 5082), origin validation via RPKI/ROAs/ROV (RFC 6480 and related), and the operational guidance of RFC 7454, alongside max-prefix limits and prefix filtering. For an analyst, an open 179 indicates a BGP speaker or peering device that should be tightly ACL'd to known peer IPs only and protected with TCP-AO/MD5 and GTSM; unexpected 179 reachability — particularly on a non-router host — is a serious finding.
- IANA assignment
bgp— "Border Gateway Protocol"; reference (blank — no RFC cited in IANA registry); assignee Kirk Lougheed; dual-registered 179/tcp + 179/udp; separate 179/sctp "BGP" cites [RFC9260] [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- common on routers/peering gear; nmap-services open-frequency ~0.0105 (de-facto) [Well-established] — nmap-services file
- Related ports
- 179 is essentially router-to-router only; 161/162 (snmp) on the same gear; 179/udp and 179/sctp siblings
Primary use
inter-domain (inter-AS) routing over long-lived TCP sessions (BGP-4, RFC 4271)
Other/unofficial uses
iBGP within an AS; route servers at IXPs [Well-established]
Security implications
no inherent origin authentication → prefix hijacks/route leaks (Pakistan/YouTube 2008; MyEtherWallet/Amazon 2018; Facebook self-withdrawal Oct 2021); mitigations TCP-MD5 (RFC2385)/TCP-AO (RFC5925)/GTSM (RFC5082)/RPKI-ROV (RFC6480)/RFC7454, max-prefix, prefix filtering
Typically seen on
routers, BGP speakers, peering points, cloud edge
- Analyst note
- An open 179 is a BGP router/peering device; ACL it to known peers only, protect with TCP-AO/MD5 + GTSM, and never leave it openly reachable. Unexpected 179 on a non-router host warrants investigation.
About port 179/udp.
Port 179/udp is registered with IANA as bgp ("Border Gateway Protocol"), assignee Kirk Lougheed, with a blank reference field — a parallel registration to the much better-known 179/tcp, which shares the same service name, description, and assignee. The practical reality is that this UDP slot is a dormant mirror: BGP requires reliable, ordered delivery of routing updates and therefore runs exclusively over TCP/179. No production router OS or BGP daemon — Cisco IOS, Juniper Junos, FRRouting, BIRD, OpenBGPD, or Quagga — sends a single byte over UDP/179, and no public scanning dataset (Shodan, Censys, Shadowserver) reports meaningful UDP/179 exposure in the wild. That makes the analyst's takeaway almost entirely a redirection: the entire BGP threat surface — route hijacking via false announcements, TCP session-reset attacks, and DDoS amplification against the session — lives on TCP/179, not here. Shadowserver's Open BGP Service Report, for example, scans TCP/179 by sending a BGP OPEN message and classifies responsive hosts as HIGH severity; there is no documented UDP/179 scan component. Real-world incidents follow the same pattern: the 2018 Amazon Route 53 BGP hijack (traffic rerouted through a Russian ISP to steal roughly $150k in cryptocurrency) was a TCP/179 routing-plane event. The IANA reference column for the UDP row is blank — no RFC is cited for this specific registration, matching the TCP row (a separate SCTP/179 registration does cite RFC 9260, modified 2022-02-07, but that is a different transport and not relevant here). For an analyst, a responsive UDP/179 is therefore anomalous: it is not how BGP works, so it warrants investigation as a misconfiguration, a decoy, or non-BGP traffic on a registered port rather than a legitimate routing session.
- IANA assignment
bgp— "Border Gateway Protocol"; reference (blank — no RFC cited in IANA registry for the UDP row); assignee Kirk Lougheed; dual-registered 179/tcp + 179/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (CSV)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no public scanning dataset (Shodan, Censys, Shadowserver) reports meaningful UDP/179 exposure; open UDP/179 responses are not a documented phenomenon [Likely] — Shadowserver Open BGP Service Report, Shodan
- Related ports
- 179/tcp (the active BGP transport); 179/sctp (RFC 9260 registration, distinct transport)
Primary use
none in practice — BGP runs exclusively over TCP/179; the UDP registration is an unused parallel IANA slot
Other/unofficial uses
no known software uses UDP/179 for active sessions
Security implications
no CVEs, malware, or attack techniques target UDP/179 specifically; the BGP security surface (hijacking, session reset, DDoS) is entirely on TCP/179; the 2018 Route 53 hijack is a well-known TCP/179 example
Typically seen on
not seen as a live service; a responsive UDP/179 is an anomaly / misconfiguration / decoy
- Analyst note
- BGP does not use UDP. Treat a responsive UDP/179 as anomalous and investigate; it is not a legitimate BGP session.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| bgp | TCP | Border Gateway Protocol | 1.05% |
| bgp | UDP | Border Gateway Protocol | 0.05% |
| bgp | SCTP | Border Gateway Protocol | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.