19
Summary
- // if you see it open
- 19/udp is one of the classic amplification/reflection DDoS vectors. US-CERT TA14-017A lists CharGEN with a bandwidth amplification factor of ~358.8x: an attacker spoofs the victim's source IP, sends a tiny 'character generation request' to an open chargen server, and the server floods the victim with a much larger response. A staple of booter/stresser services; Akamai's Q4 2014 report documented the UDP-reflection surge (NTP/CharGEN/SSDP most-used). Also half of the echo-chargen 'ping-pong' UDP packet-storm loop (CERT CA-1996-01, 1996; CVE-1999-0103; Snort SID 271). TCP chargen is NOT a reflection vector (handshake required).
- // analyst note
- An open 19/udp is a serious DDoS-reflector liability and should be closed/firewalled immediately; an open chargen of either transport indicates an unhardened/legacy host.
About port 19/tcp.
Port 19/tcp is registered with IANA as chargen with the description "Character Generator," and notably both the assignee and the reference fields are blank in the registry row (dual-registered on TCP and UDP). The Character Generator Protocol, defined in RFC 864 (Postel, May 1983), is a testing and debugging service: on TCP, once a client connects, the server sends a continuous stream of characters — the RFC suggests shifting lines of 72 ASCII characters — until the client disconnects, discarding any input; on UDP, it answers each received datagram with a single datagram containing a random number (between 0 and 512) of characters. That UDP behavior is exactly what makes chargen the security headline of this batch. 19/udp is one of the classic amplification and reflection DDoS vectors: US-CERT/CISA Alert TA14-017A ("UDP-Based Amplification Attacks") lists CharGEN with a bandwidth amplification factor of roughly 358.8x — among the highest in its table — because an attacker can spoof a victim's source address, send a tiny "character generation request" to an open chargen server, and have the server flood the victim with a far larger response. Chargen reflectors have been staple ammunition for booter/stresser services, and Akamai's Q4 2014 State of the Internet report documented the era's surge in UDP reflection attacks (NTP, CharGEN, and SSDP being the most-used protocols). Chargen is also half of the echo-chargen "ping-pong" / UDP packet-storm loop (CERT CA-1996-01, 1996; CVE-1999-0103; Snort SID 271). The TCP chargen service is not a reflection vector — TCP's handshake prevents the source-address spoofing reflection relies on — though it can still tie up resources. As one of the inetd/Cisco-IOS "small services," chargen should be disabled, and modern defaults do so. For an analyst, an open 19/udp is a serious DDoS-reflector liability that should be firewalled or closed immediately, and an open chargen of either transport signals an unhardened or legacy host.
- IANA assignment
chargen— "Character Generator"; reference (blank); assignee (blank); dual-registered 19/tcp + 19/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 19/tcp ≈ 0.002559; 19/udp ≈ 0.015865 (de-facto) [Well-established] — nmap-services file
- Related ports
- 7 (echo — ping-pong partner), 17 (qotd, 140.3x), 13 (daytime), 9 (discard); 19/udp sibling
Primary use
generate a character stream for testing/debugging (RFC 864)
Other/unofficial uses
network/throughput testing [Well-established]
Security implications
19/udp is a classic amplification/reflection DDoS vector — US-CERT TA14-017A bandwidth amplification factor ~358.8x; staple of booter/stresser services; Akamai Q4 2014 documented the UDP-reflection surge; also the echo-chargen ping-pong loop (CERT CA-1996-01, 1996; CVE-1999-0103; Snort SID 271); TCP chargen is NOT a reflection vector (handshake required)
Typically seen on
legacy Unix, Cisco IOS small-servers, exposed IoT/embedded reflectors
- Analyst note
- An open 19/udp is a serious DDoS-reflector liability and should be closed/firewalled immediately; an open chargen of either transport indicates an unhardened/legacy host.
About port 19/udp.
Port 19/udp is registered with IANA as chargen with the description "Character Generator" and a blank reference field (dual-registered on TCP and UDP — 19/tcp carries the identical service name and description). The protocol is defined in RFC 864 (J. Postel, ISI, May 1983). The UDP variant is deliberately trivial: the server listens on port 19, and when it receives any datagram it discards the contents entirely and replies with a single datagram containing an arbitrary number of characters (between 0 and 512 bytes), maintaining no state between requests. CHARGEN was intended as a testing, debugging, and measurement aid alongside the rest of the "small services" cluster, and it was historically reachable through the Unix inetd/xinetd super-servers, though it is rarely enabled by default on modern systems. The reason port 19/udp matters for an analyst today is almost entirely as an attack surface rather than a service: because UDP requires no handshake, CHARGEN is the canonical reflection/amplification vector. An attacker spoofs the victim's address as the source, sends a tiny packet to any internet-exposed CHARGEN responder, and the responder floods the victim with up to 512 bytes per request. Published amplification figures vary by methodology — NCSC Ireland cites a bandwidth amplification factor of 358.8:1, while Wikipedia and INCIBE describe a 200–1,000x range — but all point to a large multiplier from a small spoofed request. Network-connected printers and copiers, legacy embedded devices, older server installs, and home routers with stale firmware are the populations most often found exposed, because they rarely receive updates. Shadowserver classifies open CHARGEN as a MEDIUM-severity finding and scans for it continuously; CISA's TA14-017A (2014) lists CHARGEN among UDP-based amplification protocols. There is no legitimate production reason to leave it exposed, so for an analyst a responsive 19/udp is best treated as a misconfiguration and a DDoS-reflector liability rather than a normal service — mitigations are BCP38 ingress filtering against spoofed sources, disabling CHARGEN on any internet-facing device, and rate-limiting UDP port 19.
- IANA assignment
chargen— "Character Generator"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 19/tcp + 19/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cachedthe IANA Service Name and Transport Protocol Port Number Registry, line 43)- Range class
- well-known (0–1023) [Confirmed]
- Related ports
- the small-services cluster (7, 9, 11, 13, 17, 37); 19/tcp (identical IANA registration)
Primary use
Character Generator Protocol (RFC 864, Postel, May 1983) — on UDP the server replies to any datagram with 0–512 arbitrary characters, ignoring the request payload and keeping no state; intended for testing/debugging/measurement
Other/unofficial uses
historically reachable via Unix inetd/xinetd; widely shipped enabled on network printers/copiers; legacy server and home-router firmware
Security implications
canonical UDP reflection/amplification DDoS vector — spoofed-source request triggers up to 512 bytes of response; amplification BAF 358.8:1 (NCSC Ireland) to 200–1,000x (Wikipedia/INCIBE); Shadowserver rates open CHARGEN MEDIUM and scans continuously; CISA TA14-017A (2014) lists it among UDP amplification protocols
Typically seen on
internet-exposed printers/copiers, legacy embedded devices, older server installs, and home routers with stale firmware; otherwise a misconfiguration
- Amplification factor
- BAF 358.8:1 per NCSC Ireland; 200–1,000x range per Wikipedia/INCIBE (figures differ by measurement methodology) [Likely] — https://www.ncsc.gov.ie/emailsfrom/reports/ddos/chargen/
- Analyst note
- A responsive 19/udp is rarely a legitimate service — treat it as a DDoS-reflector liability and likely misconfiguration; recommend BCP38 ingress filtering, disabling CHARGEN on internet-facing devices, and rate-limiting UDP port 19.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| chargen | UDP | ttytst source Character Generator | 1.59% |
| chargen | TCP | ttytst source Character Generator | 0.26% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.