186

Port 186/tcp is registered with IANA under the service name kis, described simply as "KIS Protocol," with assignee and contact both listed as [Ralph_Droms] and no reference RFC on file; the entry is dual-registered on 186/udp with identical fields. KIS stands for Knowbot Information Service, a pre-Web, whois-like directory and user-lookup service developed and operated by the Corporation for National Research Initiatives (CNRI) in Reston, Virginia, reportedly launched around December 1989. Rather than querying a single directory, a KIS client dispatched mobile query agents ("Knowbots") that fanned out to a variety of remote lookup services — whois, finger, X.500, and MCI Mail among them — and returned a unified result to the user, an ambitious design for its era that predates most modern federated-identity concepts. The earliest confirmed documentary trace of the port/service-name pairing found here is RFC 1700 ("Assigned Numbers," October 1994), though the service itself is older; no single RFC was located that formally specifies the KIS wire protocol, and none is asserted. There is no evidence of any contemporary software implementing KIS — it reads as a dormant, historical registry entry. Passive scan-telemetry from SANS ISC shows only low-volume, non-targeted background scanning on port 186, consistent with generic internet-wide probing rather than any protocol-specific exploitation, and no CVE or malware family was found tied to this port.

IANA assignment

kis — "KIS Protocol"; reference (blank — no RFC cited in IANA registry); assignee/contact [Ralph_Droms]; dual-registered 186/tcp + 186/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 458–459); IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Related ports

conceptually adjacent to other directory/lookup services (e.g., whois 43, finger 79), though KIS itself fanned out to those rather than replacing them

Primary use

Knowbot Information Service (KIS) — a pre-Web directory/user-lookup service built and run by CNRI, launched circa December 1989, fanning queries out to whois/finger/X.500/MCI Mail via mobile "Knowbot" agents

Protocol specification

no single authoritative RFC formally specifying the KIS wire protocol could be confirmed (RFC 1509 was checked and ruled out — GSS-API C bindings, unrelated) [Unknown]

Other/unofficial uses

none found; no evidence of any current client/server software implementing KIS [Unknown]

Security implications

SANS ISC reports only low-volume, non-specific background scan traffic on port 186 (as of 2026-07-11); no CVE or malware family found associated with this port

Typically seen on

no contemporary deployments identified; a legacy 1990s registry entry with no verified live usage today

Earliest documented reference found

RFC 1700, "Assigned Numbers," October 1994 (service itself predates this; earlier documentation plausible but unverified) [Likely] — https://datatracker.ietf.org/doc/html/rfc1700

Analyst note

an open/responsive 186/tcp today would be unexpected given no known modern software uses this assignment; treat as anomalous and worth investigating rather than assuming legitimate KIS traffic.

Port 186/udp is registered with IANA under the service name kis, description "KIS Protocol," with Ralph Droms listed as both assignee and contact. The registry's Reference column is blank for this entry, so no RFC or other reference document is formally cited by IANA — that blank is preserved here rather than filled in with a guess. The row is dual-registered: 186/tcp carries the identical service name, description, assignee, and blank reference, confirming both transports were assigned together. Historically, the name "kis" plausibly traces to the Knowbot Information Service, a circa-1989 Internet directory meta-search tool that queried WHOIS, Finger, X.500, and MCI Mail through "Knowbot" subprograms and returned a unified result set. However, the primary description of that service, RFC 1739 ("A Primer on Internet and TCP/IP Tools," December 1994), documents access via Telnet to port 185 on info.cnri.reston.va.us — not port 186 — and IANA's own port-186 entry cites no reference at all, so the RFC 1739 connection is useful historical color but circumstantial rather than a confirmed link specific to this port. A closely-named, easily confused adjacent entry exists at port 185 ("remote-kis"/"Remote-KIS"), which carries no assignee or contact. No current mainstream software, scanning-campaign writeup, or malware/trojan association for 186/udp was found in this research pass, so those aspects are reported honestly as unknown rather than invented.

IANA assignment

kis — "KIS Protocol"; Reference column blank in registry; assignee/contact [Ralph_Droms]; dual-registered 186/tcp + 186/udp (identical row content) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (and :458 for the tcp row); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023) [Confirmed]

Prevalence (nmap-services open-frequency)

0.00028 for kis on 186/udp — about 0.03% of sampled hosts; the 186/tcp sibling is recorded at 0.000000, meaning no host in the scan sample was seen with the TCP side open, so what little activity the dataset captures is UDP-side only [Confirmed] — nmap-services dataset

Primary use / historical context

name plausibly derives from the Knowbot Information Service, a late-1980s/early-1990s Internet directory meta-search tool; RFC 1739 (Dec 1994) describes that service reached via Telnet on port 185, not 186, and IANA cites no reference for port 186 itself, so the link is circumstantial rather than a confirmed formal linkage

Common software today

no current mainstream client or server implementing the KIS protocol on port 186 was identified; KIS as a live public service is defunct

Security implications / malware associations

no documented scanning campaigns, honeypot signatures, or trojan/malware associations specific to 186/udp were found; general trojan-port reference lists do not list it

Typically seen on

no current deployment pattern identified; given the protocol is a defunct 1990s directory-lookup tool, any live exposure found today is more likely coincidental/misconfigured than an active KIS deployment — this is inference, not a sourced finding [Unknown]

Related/adjacent entry

port 185 (tcp/udp) is separately registered as "remote-kis"/"Remote-KIS" with no assignee or contact listed, and is easily confused with 186/kis [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt