1812

Port 1812/tcp is registered with IANA as radius with the description "RADIUS" and the reference [RFC2865], the foundational RADIUS specification (Rigney et al., June 2000). The assignee, contact, registration-date, and modification-date columns are blank in the IANA registry; 1812 is dual-registered, carrying the same service name, description, and RFC reference on both TCP and UDP. RADIUS — Remote Authentication Dial In User Service — is the centralized AAA (Authentication, Authorization, Accounting) protocol that lets a Network Access Server (NAS) defer access decisions to a backend server; it underpins WPA2/WPA3-Enterprise Wi-Fi, 802.1X wired port authentication, VPN gateways, and broadband/dial-up access. In practice the protocol runs over UDP/1812, and that is where almost all real traffic lives. TCP/1812 specifically exists because RFC 6613 (May 2012) standardized RADIUS over TCP, intended primarily for inter-proxy paths — roaming federations and proxy chains — rather than direct NAS-to-server flows; RFC 6613 explicitly states bare TCP on 1812 MUST NOT be used without a securing layer such as TLS or IPsec. Historically RADIUS first squatted on UDP/1645 (which collided with the registered datametrics service), and RFC 2865 reassigned it to 1812. For an analyst, port 1812 is interesting both as an enterprise-infrastructure marker and as a security-sensitive surface: RADIUS servers should not be internet-facing, and CVE-2024-3596 ("Blast-RADIUS," disclosed July 2024, CVSSv3 8.1) showed that an on-path attacker can forge Access-Accept responses by exploiting an MD5 weakness in the protocol, affecting both UDP and TCP/1812. Mitigations are to enforce Message-Authenticator on every packet, wrap RADIUS in TLS (RadSec, 2083) / DTLS / IPsec, and block 1812 at the internet perimeter. Common implementations include FreeRADIUS, Microsoft Network Policy Server (NPS), Cisco ISE, Aruba ClearPass, and Juniper Steel-Belted Radius.

IANA assignment

radius — "RADIUS"; reference [RFC2865]; assignee/contact blank; dual-registered 1812/tcp + 1812/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; the IANA Service Name and Transport Protocol Port Number Registry line 3376

Range class

registered (1024–49151)

Related ports

1813 (RADIUS Accounting), 1645/1646 (legacy RADIUS), 2083 (RadSec / RADIUS over TLS)

Primary use

RADIUS AAA — authentication requests between a NAS and a RADIUS server. On TCP specifically, RFC 6613 designates 1812/tcp for RADIUS-over-TCP, intended mainly for inter-proxy / roaming-federation paths; UDP/1812 remains the norm for direct NAS-to-server flows

Common software

FreeRADIUS (Linux); Microsoft Network Policy Server (NPS); Cisco Identity Services Engine (ISE); Aruba ClearPass; Juniper Steel-Belted Radius. Used in WPA2/WPA3-Enterprise Wi-Fi, 802.1X wired authentication, VPN gateways, and broadband/dial-up access

Security implications

RADIUS servers should not be internet-facing. CVE-2024-3596 ("Blast-RADIUS," July 2024, CVSSv3 8.1) lets an on-path attacker forge Access-Accept responses via an MD5 weakness, affecting both UDP and TCP/1812. Mitigations: enforce Message-Authenticator on all packets; wrap in RADIUS/TLS (RadSec, 2083), RADIUS/DTLS, or IPsec; block 1812 at the perimeter. RFC 6613 requires a secure upper layer for bare TCP/1812

Typically seen on

enterprise authentication infrastructure (NPS/ISE/FreeRADIUS servers, Wi-Fi controllers, VPN concentrators); proxy/roaming federations on the TCP variant

Historical note

RADIUS first used UDP/1645 (collided with datametrics); RFC 2865 (2000) reassigned it to 1812. TCP transport standardized later by RFC 6613 (2012) [Confirmed] — RFC 2865, Cisco RADIUS reference

RFC references

RFC 2865 (RADIUS core, 2000); RFC 2866 (RADIUS Accounting, 2000); RFC 6613 (RADIUS over TCP, 2012) [Confirmed] — IETF datatracker

Analyst note

Port 1812 on TCP is the RADIUS-over-TCP / inter-proxy variant; real volume is overwhelmingly UDP. An internet-exposed 1812 listener is a misconfiguration worth flagging — and a Blast-RADIUS (CVE-2024-3596) target if Message-Authenticator or a TLS/IPsec wrapper is absent.

Port 1812/udp is registered with IANA as radius with the reference [RFC2865]; it is dual-registered on both TCP and UDP, and in practice the UDP listener is what RADIUS deployments use. RADIUS (Remote Authentication Dial-In User Service) is the centralized Authentication, Authorization, and Accounting (AAA) protocol that lets network access servers — VPN concentrators, Wi-Fi controllers, switches doing 802.1X, dial and broadband gateways — defer the "who are you and what may you do" decision to a single back-end server. RFC 2865 (Rigney, Willens, Rubens, Simpson; June 2000) assigns UDP 1812 as the authentication destination port, and its companion RFC 2866 assigns UDP 1813 for accounting. Port 1812 superseded the legacy de-facto port 1645/udp, which collided with the registered datametrics service; many servers (FreeRADIUS, Microsoft NPS) still listen on 1645 for backward compatibility but 1812 is the standards-correct port. For an analyst the important context is that 1812/udp belongs strictly on a management or NAS-to-server segment: the protocol's packet integrity rests on MD5, and CVE-2024-3596 ("BlastRADIUS," disclosed July 2024) showed an on-path attacker can forge Access-Accept responses, so any internet-exposed 1812/udp is a misconfiguration. Because it is UDP, scanning is unreliable — without a valid RADIUS reply, open and filtered are indistinguishable.

IANA assignment

radius — "RADIUS"; reference [RFC2865]; assignee/contact/registration date/modification date all blank in the registry (confirmed nulls, not unknowns); dual-registered 1812/tcp + 1812/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 3377)

Range class

registered (1024–49151)

Related ports

1813/udp (RADIUS accounting), 1645/1646/udp (legacy RADIUS auth/acct), 1812/tcp (dual-registered, rarely used)

Primary use

RADIUS authentication/authorization destination port; centralized AAA for network access (RFC 2865, June 2000)

Common software

FreeRADIUS (Linux); Microsoft Network Policy Server (NPS) built into Windows Server; Cisco IOS/NX-OS RADIUS clients; switches/VPN concentrators as RADIUS clients — FreeRADIUS and NPS both listen on 1812/udp by default

Security implications

CVE-2024-3596 ("BlastRADIUS," disclosed July 2024) — protocol-level MD5 weakness lets an on-path attacker forge Access-Accept responses; mitigations are enforcing the Message-Authenticator attribute and tunneling RADIUS in TLS/DTLS (RadSec), IPsec, or MACsec. 1812/udp must never face the public internet; firewall it to NAS↔server traffic

Exposure/scanning notes

appears in Shodan/Censys scans but public exposure is a misconfiguration; UDP makes scanning inconclusive (open vs. filtered ambiguous without a valid RADIUS reply)

Typically seen on

enterprise NAS/AAA infrastructure (Wi-Fi controllers, VPN concentrators, 802.1X switches, broadband gateways) on management/dedicated networks

Companion port

1813/udp is the RADIUS accounting port (RFC 2866) [Confirmed] — RFC 2866

Legacy predecessor

port 1645/udp (de-facto, collided with registered datametrics); still accepted by some servers for backward compatibility [Confirmed] — https://datatracker.ietf.org/doc/html/rfc2865

Analyst note

An internet-facing 1812/udp is a misconfiguration; expect RADIUS only on internal NAS-to-server segments, and weigh CVE-2024-3596 when assessing an exposed deployment.