18

Port 18/tcp is registered with IANA as msp with the description "Message Send Protocol (historic)," assignee Rina Nethaniel, and a blank reference field (dual-registered on TCP and UDP). The Message Send Protocol was first specified in RFC 1159 (R. Nelson, Clarkson University, June 1990; Experimental) and then revised as Message Send Protocol 2 in RFC 1312 (Nelson and Arnold, April 1992, which obsoletes RFC 1159). Its purpose is to deliver a short message — under 512 octets — to a designated user, terminal, or host, broadly comparable to the Unix write command or a network "SEND," so that one machine can pop a brief notice onto another user's screen. MSP version 2 added fields for SENDER, SENDER-TERM, a COOKIE, and a SIGNATURE, the last of which supports a degree of sender-identity verification. The protocol is long obsolete, and the IANA description itself marks it "(historic)"; the reference field is blank. It is not a notable amplification or attack vector, and its security relevance today is essentially that, like the other small services of its era, it should not be running on a modern host. For an analyst, an open MSP port is best read as obsolescence and a reconnaissance signal — a marker of legacy cruft on a very old system — and removed rather than investigated as an active threat.

IANA assignment

msp — "Message Send Protocol (historic)"; reference (blank — no RFC cited in IANA registry); assignee Rina Nethaniel; dual-registered 18/tcp + 18/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 18/tcp ≈ 0.000000 (extremely rare); 18/udp ≈ 0.000610 (de-facto) [Well-established] — nmap-services file

Related ports

the small-services cluster 7/9/11/13/17/19; contrast modern messaging/notification

Primary use

send a short message to a user/terminal/host (RFC 1159; MSP2 = RFC 1312)

Other/unofficial uses

obsolete; effectively none today [Well-established]

Security implications

obsolete; not a notable amplification vector; should be disabled if present (legacy small service) [Well-established]

Typically seen on

very old Unix hosts; effectively never seen in modern environments

Analyst note

An open MSP port is an obsolescence/recon signal; treat as legacy cruft and remove.

Port 18/udp is registered with IANA as msp with the description "Message Send Protocol," assignee [Rina_Nethaniel] (an IANA contact handle), and a blank reference field (dual-registered on TCP and UDP — the identical msp record sits on 18/tcp). The Message Send Protocol is an application-layer protocol for delivering short plain-text messages from one user to another across Internet hosts, conceptually like the Unix write command but spanning hosts rather than a single machine. The original protocol was defined in RFC 1159 (R. Nelson, June 1990) and was superseded two years later by Message Send Protocol 2 in RFC 1312 (R. Nelson, April 1992), which added the SENDER, SENDER-TERM, COOKIE, and SIGNATURE fields and refined the acknowledgement behaviour. Over UDP the service is connectionless: the server listens on UDP port 18 and, on receipt of a datagram, echoes the same data back to the sender as a positive acknowledgement; under MSP 2 that reply is sent only when the message was addressed to a specific user and was successfully delivered, suppressing spurious replies to broadcast messages. The protocol predates modern instant-messaging infrastructure, and RFC 1159 itself states that "Security issues are not addressed in this memo," advising servers to strip escape sequences before forwarding text to terminals to prevent terminal damage. RFC 1312 is more explicit: it warns that the protocol may allow unauthorized terminal access (users should be able to disable message receipt), that message-text filtering is critical to prevent injection, and that sender identity is unverifiable without additional mechanisms — the SIGNATURE field was introduced as a partial mitigation — concluding that MSP is suited only for "open, controlled network environments with trusted participants." MSP is effectively obsolete today: its use case has been entirely replaced by SMTP, XMPP, and HTTPS-based messaging, and no active successor protocol occupies the port. For an analyst, port 18 is a low-signal, legacy assignment: SANS ISC reports a "green" threat level with negligible scan activity and no CVEs listed against the port, so a responsive UDP port 18 is statistically rare and more likely an academic, legacy, or misconfigured listener than a live service. Because it is a UDP echo-style service, an exposed MSP listener could in principle be abused for UDP reflection or amplification, but no documented campaigns targeting port 18 specifically have been found in available sources.

IANA assignment

msp — "Message Send Protocol"; reference (blank — no RFC cited in IANA registry); assignee/contact [Rina_Nethaniel]; dual-registered 18/tcp + 18/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (P:\networklookup\enrichment\registries\the IANA Service Name and Transport Protocol Port Number Registry line 41)

Range class

well-known (0–1023) [Confirmed]

Status

obsolete / legacy — RFC 1159 obsoleted by RFC 1312; no active successor protocol on the port; use case replaced by SMTP, XMPP, and HTTPS-based messaging [Confirmed] — RFC 1159, Wikipedia (Message Send Protocol)

Registration/modification dates

Unknown — IANA does not publish a registration date for this assignment; third-party "date registered" values in port databases are database artifacts, not IANA-sourced [Confirmed]

Related ports

the small-services / legacy text-protocol cluster (7, 9, 11, 13, 17, 19); contrast modern messaging (SMTP/25, XMPP)

Primary use

name-based plain-text user-to-user message delivery across hosts; UDP variant is connectionless and echoes received datagrams as acknowledgement (RFC 1159; RFC 1312 refines the echo)

Other/unofficial uses

none documented; no widely-deployed named implementations appear in the RFCs or current sources

Security implications

RFC 1159 explicitly does not address security and advises stripping escape sequences before forwarding to terminals; RFC 1312 warns of possible unauthorized terminal access, the need for message-text filtering against injection, and unverifiable sender identity (SIGNATURE field as partial mitigation); suited only for trusted, controlled environments. SANS ISC threat level "green" (low scan activity), no CVEs listed against the port

Exposure/scanning

low overall internet scan activity (SANS ISC green / no current reports as of June 2026); as a UDP echo-style service an exposed listener could theoretically be used in reflection/amplification abuse, but no documented port-18 campaigns found

Typically seen on

legacy or academic hosts; otherwise an anomaly / misconfiguration

Defining RFCs

RFC 1159 (June 1990) — original Message Send Protocol, now obsolete; RFC 1312 (April 1992) — Message Send Protocol 2, supersedes RFC 1159; added SENDER, SENDER-TERM, COOKIE, SIGNATURE fields [Confirmed] — RFC 1159, RFC 1312

Analyst note

An open UDP port 18 is statistically rare and legacy; treat as an anomaly worth investigating, and consider UDP reflection exposure if a live MSP echo listener is found.