1813

Port 1813/tcp is registered with IANA as radius-acct with the description "RADIUS Accounting," dual-registered on both TCP and UDP, and carrying the IANA reference [RFC2866]. In practice the accounting protocol is authoritative on UDP — RFC 2866 (RADIUS Accounting, C. Rigney, June 2000) defines port 1813/udp as the transport over which a Network Access Server (NAS) sends Accounting-Request messages to a RADIUS accounting server, which replies with Accounting-Response. These records mark session lifecycle events (Acct-Status-Type Start, Interim-Update, Stop) and carry resource metrics — octets and packets transferred, session duration — used for billing, auditing, and capacity planning. The TCP variant on 1813 is a real but uncommon assignment: RFC 6613 (RADIUS over TCP, June 2012) explicitly assigns radius-acct on 1813/tcp for deployments that want reliable transport or a TLS wrapper, but most production AAA traffic still runs over UDP. Port 1813 is accounting-only; its companion 1812 carries RADIUS authentication and authorization. Historically, early RADIUS accounting used UDP port 1646 before the official 1813 assignment, and some legacy gear may still default to 1646. The protocol's relevance to an analyst is dominated by BlastRADIUS (CVE-2024-3596, disclosed July 2024, CVSS 9.0): a fundamental flaw in RADIUS over UDP lets an on-path attacker exploit MD5 collisions to forge server responses, since certain packets lack integrity protection. Accounting traffic on 1813 rides the same protocol stack; mitigations include enforcing the Message-Authenticator attribute, tunnelling over RadSec (TLS, 2083/tcp) or IPsec, and patching server and NAS firmware. RADIUS accounting is an internal AAA protocol, so an Internet-facing port 1813 is a misconfiguration and a reconnaissance target rather than a normal exposure.

IANA assignment

radius-acct — "RADIUS Accounting"; reference [RFC2866]; dual-registered 1813/tcp + 1813/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered (1024–49151)

Related ports

1812 (RADIUS auth), 1645/1646 (legacy RADIUS auth/acct), 2083 (RadSec/RADIUS-over-TLS)

Primary use

RADIUS Accounting — NAS sends Accounting-Request (Start / Interim-Update / Stop) to a RADIUS accounting server, which replies Accounting-Response; records session events and resource usage (octets, duration) for billing/auditing

Common software

FreeRADIUS (Linux/BSD); Microsoft Network Policy Server (NPS); Cisco Identity Services Engine (ISE); Aruba ClearPass; Cisco IOS/NX-OS devices as NAS clients

Security implications

BlastRADIUS (CVE-2024-3596, July 2024, CVSS 9.0) — MD5-collision forgery of RADIUS/UDP responses by an on-path attacker; accounting traffic shares the stack. Mitigate via Message-Authenticator enforcement, RadSec/TLS (2083/tcp) or IPsec, firmware updates. Internet-facing 1813 is a misconfiguration/recon target

Typically seen on

private AAA management networks between NAS devices and RADIUS servers; public exposure is an anomaly

Transport

authoritative on UDP (RFC 2866); 1813/tcp is an assigned but uncommon alternative per RFC 6613 (RADIUS over TCP) [Confirmed] — RFC 2866, RFC 6613

Companion port

1812 = RADIUS authentication/authorization; 1813 is accounting-only [Confirmed] — IANA registry, RFC 2865/2866

Historical

early RADIUS accounting used UDP 1646 before the 1813 assignment; some legacy gear may still default to 1646 [Likely] — RFC 2866 background

Analyst note

1813 is accounting-only; an Internet-facing instance suggests misconfigured firewalls or a rogue/honeypot host. Evaluate BlastRADIUS exposure for any RADIUS deployment regardless of transport.

Port 1813/udp is registered with IANA as radius-acct with the description "RADIUS Accounting" and reference [RFC2866]; the assignee, contact, registration-date, and modification-date columns are blank in the registry. It is dual-registered (1813/tcp carries the identical service name, description, and RFC reference), though in practice RADIUS runs over UDP. RFC 2866 (Rigney, Livingston, June 2000; obsoletes RFC 2139) defines the accounting half of RADIUS: a Network Access Server sends Accounting-Request messages to a RADIUS accounting server and receives Accounting-Response acknowledgements, recording session start/stop events and usage metrics such as session duration, bytes and packets transferred, the assigned IP address, and the termination reason. It is the companion to 1812/udp, the RADIUS authentication port defined by RFC 2865; a legacy alternative port, 1646/udp, predates the IANA assignment and collides with the sa-msg-port service. The dominant platforms are FreeRADIUS on Linux/Unix and Microsoft Network Policy Server on Windows Server (which listens on 1812, 1813, 1645, and 1646 by default), with Cisco ISE and Radiator also common; firewalls and gateways such as pfSense/OPNsense act as RADIUS clients forwarding to these servers. For an analyst, the defining security event is BlastRADIUS (CVE-2024-3596, disclosed July 2024, CVSS 8.1): a protocol-level flaw in RADIUS/UDP's MD5 integrity check lets an on-path attacker forge an Access-Accept via a chosen-prefix MD5 collision, affecting both 1812 and 1813 wherever the Message-Authenticator attribute is absent or unenforced. EAP-based Wi-Fi (802.1X/eduroam) is not affected because Message-Authenticator is mandatory there. Mitigations are to patch RADIUS software, enforce Message-Authenticator on every client, and migrate to RADIUS/TLS (RadSec, RFC 6614) or RADIUS/DTLS. RADIUS servers should never be internet-facing; 1813/udp belongs on a management VLAN or VPN segment, and its accounting logs (assigned IPs, session times, data volumes) are a forensic asset worth retaining.

IANA assignment

radius-acct — "RADIUS Accounting"; reference [RFC2866]; assignee, contact, registration-date and modification-date columns all blank in the registry (recorded as null, not fabricated); dual-registered 1813/tcp + 1813/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 3379) + https://www.rfc-editor.org/rfc/rfc2866

Range class

registered (1024–49151)

IANA Reference column

[RFC2866] present (the only reference cell populated; assignee/dates blank) [Confirmed] — registry

Primary use

RADIUS Accounting — Accounting-Request/Accounting-Response between a NAS and a RADIUS accounting server; records session start/stop, duration, bytes/packets, assigned IP, termination reason (RFC 2866)

Common software

FreeRADIUS (dominant on Linux/Unix); Microsoft Network Policy Server (listens on 1812/1813/1645/1646 by default); Cisco ISE; Radiator; pfSense/OPNsense as RADIUS clients

Security implications

BlastRADIUS (CVE-2024-3596, July 2024, CVSS 8.1) — MD5 integrity flaw on RADIUS/UDP lets an on-path attacker forge Access-Accept; affects 1812 and 1813 when Message-Authenticator is absent/unenforced; EAP/802.1X unaffected. Protocol does not encrypt accounting payloads (shared-secret + MD5 only). Should never be internet-facing. [Confirmed] — https://ccb.belgium.be/advisories/warning-high-severity-vulnerability-affecting-radius-protocol, https://www.cyber.gc.ca/en/alerts-advisories/radius-protocol-susceptible-forgery-attacks

Companion / related ports

1812/udp RADIUS authentication (RFC 2865); legacy 1646/udp (predates IANA assignment, collides with sa-msg-port) [Confirmed] — https://www.ietf.org/rfc/rfc2866.txt

Internet exposure / scan count

Unknown (no public scan statistic verified — Shodan not queryable without login); exposure guidance is from authoritative firewall documentation, not a measured count [Unknown]

Analyst note

A 1813/udp listener is a RADIUS accounting server — pair it with a 1812/udp authentication listener; treat any internet-facing exposure and any unpatched/Message-Authenticator-less deployment as a BlastRADIUS risk.