187

Port 187/tcp is registered with IANA as aci, short for "Application Communication Interface," assigned to Rick Carlos with no RFC or other IANA reference cited, and dual-registered on both 187/tcp and 187/udp with identical service name, description, assignee, and contact fields. The IANA registration-date and modification-date columns are blank in the current registry snapshot, so both are recorded as Unknown rather than invented — this is a gap in the source, not a researched fact. Beyond the bare registry entry, no widely documented or currently deployed application is known to actually implement this service: a light research pass across independent port-lookup references (SpeedGuide, tcp-udp-ports.com, reddlegg.com, carl.net) turned up only templated restatements of the IANA name and description, with no elaboration on real software, protocol behavior, or a client/server implementation. On the security side, port 187 does not appear on Gary Kessler's well-known "Bad Ports" reference of trojan/malware-associated ports, and no CVEs or internet-wide scanning studies referencing this port were located in this pass. One generic port-lookup aggregator (auditmypc.com) tags it "Virus/Trojan: No," but that site applies the identical boilerplate line to every port in its database regardless of actual risk, so it is not treated as a substantive security finding here. Net effect for an analyst: 187/tcp is a legitimate but essentially dormant IANA reservation with no confirmed real-world footprint, so an unexpected open port 187 should be investigated on its own merits rather than matched against any known-good or known-bad signature.

IANA assignment

aci — "Application Communication Interface"; reference blank (no RFC cited in registry); assignee/contact Rick Carlos ([Rick_Carlos]); dual-registered 187/tcp + 187/udp with identical fields [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry lines 460–461; IANA Service Names and Port Numbers Registry

Range class

well-known (0–1023)

Registration date / modification date

Unknown — Registration Date and Modification Date columns are blank in the source CSV for this entry, left null per no-fabrication rule [Confirmed (absence confirmed)] — the IANA Service Name and Transport Protocol Port Number Registry line 460

Prevalence

Unknown — no nmap-services or scanning-study data was available in this pass to source an open-frequency figure

Related ports

Unknown — not established in this research pass

Primary use

no widely-documented, currently-deployed application confirmed to implement this generically-named reservation; third-party port databases only echo the IANA name/description without elaboration

Other/unofficial uses

Unknown — none identified in this pass

Security implications

does not appear on Gary Kessler's Bad Ports (trojan/malware) reference; no CVEs or internet-wide scanning studies found referencing this port; a generic "Virus/Trojan: No" tag from auditmypc.com is boilerplate applied site-wide and not treated as a substantive signal

Typically seen on

Unknown — no common software or deployment context identified

Analyst note

treat an open port 187 as a dormant/rare IANA reservation with no confirmed real-world footprint rather than a recognized service or known threat signature.

Port 187/udp is registered with IANA under the service name aci, described as "Application Communication Interface," with Rick Carlos listed as the assignee and contact of record. The registration is dual — the same service name, description, and contact appear on both 187/tcp and 187/udp lines of the current IANA Service Name and Transport Protocol Port Number Registry — but the entry carries no RFC or reference field, no registration or last-modified date, and no service code, so those attributes are recorded as blank/unknown rather than guessed or backfilled. Because 187 falls below 1024 it sits in the well-known port range, though in practice aci is an obscure, rarely-invoked legacy assignment: it does not appear in commonly-cited lists of frequently-encountered ports (e.g., Wikipedia's List of TCP and UDP port numbers), and no mainstream software product or protocol implementation is documented as actively using it today. Generic consumer port-lookup databases (SpeedGuide, AuditMyPC) apply a boilerplate "historically associated with Trojan/virus activity" disclaimer across broad swaths of the port space, including 187/udp, but neither site names a specific malware family, campaign, or CVE tied to this port — AuditMyPC's own detail page in fact answers "No" when asked whether a currently active virus or trojan uses it. For an analyst, an open 187/udp is best treated as a low-signal anomaly worth noting because the service is unusual and rarely legitimate, not as a confirmed indicator of compromise or an active exploit path.

IANA assignment

aci — "Application Communication Interface"; reference (blank — no RFC cited in IANA registry); assignee Rick Carlos; dual-registered 187/tcp + 187/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

Range class

well-known (0–1023) [Confirmed] — numeric range fact

Registration/modification date

Unknown — IANA registry publishes no date field for this record; not invented [Unknown] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

Prevalence in real-world use

nmap-services observed open-frequency 187/udp ≈ 0.000395 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 187/tcp row carries a frequency of 0 — never observed open in that sample, so what little activity the port number shows sits on the UDP side

[Confirmed] — nmap-services dataset

Related ports

187/tcp (same service name/description/contact, dual IANA registration) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Primary use

no protocol specification, RFC, or vendor documentation found beyond the bare IANA name/description

Common software in practice

not documented as an actively-used port; absent from Wikipedia's list of commonly-encountered TCP/UDP ports

Security implications

generic port-lookup sites apply a broad, multi-port "historically flagged" disclaimer to 187/udp; no specific malware family, campaign, or CVE confirmed; AuditMyPC's own page answers "No" to a currently-active-threat question for this port

Analyst note

treat an open 187/udp as a low-signal anomaly given its obscurity, not as a known active threat indicator.