194
Summary
- // if you see it open
- General IRC risks apply (plaintext by default; historic botnet command-and-control — see the 6667 entry). But 194 specifically is almost never open, so it is primarily a curiosity; genuine IRC is far more likely on 6667/6697.
- // analyst note
- An open 194 is unusual — fingerprint it (proper IRC server, port-squatter, or rarely C2). Cross-reference the 6667 entry for the bulk of IRC analysis.
About port 194/tcp.
Port 194/tcp is registered with IANA as irc with the description "Internet Relay Chat Protocol," assignee Jarkko Oikarinen, and a blank reference field (dual-registered on TCP and UDP). This is the official, IANA-assigned system port for Internet Relay Chat — the same protocol covered by the de-facto port 6667 entry. IRC was created by Jarkko Oikarinen at the University of Oulu in August 1988 and standardized as RFC 1459 (May 1993, Oikarinen and Reed), later refined by RFC 2810–2813. The key practical point is that although 194 is the registered "official" port, the world overwhelmingly runs IRC on 6667 and the surrounding 6660–6669 range (and 7000): because 194 sits in the privileged sub-1024 range, binding it requires root on Unix, so early student and researcher operators avoided it, and 194 has been rarely used in practice ever since. TLS-secured IRC has its own system port 994 (ircs), and the de-facto TLS port is 6697 (ircs-u, RFC 7194). The IANA reference field is blank. Security-wise the general IRC risks apply — plaintext by default and a long history of botnet command-and-control (see the 6667 entry for the bulk of that analysis) — but port 194 specifically is almost never open, so it is primarily a curiosity. For an analyst, an open 194 is unusual and worth fingerprinting: it could be a deliberately "proper" IRC server, a non-IRC service squatting the port, or, rarely, C2 — and genuine IRC traffic is far more likely to be found on 6667 or 6697.
- IANA assignment
irc— "Internet Relay Chat Protocol"; reference (blank — no RFC cited in IANA registry); assignee Jarkko Oikarinen; dual-registered 194/tcp + 194/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- rare on 194; the IRC ecosystem lives on 6667/6697 (de-facto) [Well-established] — nmap-services file
- Related ports
- 6667 (de-facto IRC, ircu), 6660–6669/7000 (IRC range), 994 (ircs, TLS system port), 6697 (ircs-u, de-facto TLS); 194/udp sibling
Primary use
Internet Relay Chat (the official/registered IRC port), RFC 1459
Other/unofficial uses
rarely used in practice; the world uses 6667/6660–6669 [Well-established]
Security implications
general IRC risks (plaintext default, historic botnet C2 — see 6667); 194 specifically almost never open [Well-established/Threat-reported]
Typically seen on
rare IRC servers; otherwise anomalous
- Analyst note
- An open 194 is unusual — fingerprint it (proper IRC server, port-squatter, or rarely C2). Cross-reference the 6667 entry for the bulk of IRC analysis.
About port 194/udp.
Port 194/udp is registered with IANA as irc with the description "Internet Relay Chat Protocol," assignee Jarkko Oikarinen (the original author of IRC), and a blank reference field. The assignment is dual-registered: both 194/tcp and 194/udp carry the identical irc entry, so the UDP row is a symmetric mirror of the TCP one rather than a distinct protocol. There is no RFC cited in the IANA registry row for this port — the assignment predates the standards-track work on IRC over TLS, and RFC 7194 (which standardizes 6697/tcp for IRC-over-TLS) explicitly notes that 194 is the official-but-unused IRC port. In practice IRC is a TCP-oriented, line-based, plaintext protocol: a client connects to an IRCd, joins channels, and exchanges CRLF-terminated text commands; there is no documented, meaningful UDP use of port 194. The historical reason 194 went unused is that it sits below 1024, so binding it requires root/administrator privileges — the IRC community standardized instead on the unprivileged 6667/tcp for plaintext and later 6697/tcp for TLS. Every mainstream server (UnrealIRCd, InspIRCd, ircd-hybrid, ngIRCd) and client (irssi, WeeChat, HexChat, mIRC) uses those high TCP ports, not 194. For an analyst, the practical significance of 194/udp is its near-total absence: internet-wide scanners and pentesting references describe live IRC on 6660–6669/tcp and 7000/tcp, not on 194, and historical IRC-based botnet C2 (EggDrop-derived bots and later families) likewise operated on 6667/tcp or custom high ports rather than 194. There is no documented legitimate software or malware that uses the 194/udp combination, so unexpected UDP traffic to or from this port is anomalous and worth investigating, but the port is not a known active attack surface as of 2026.
- IANA assignment
irc— "Internet Relay Chat Protocol"; reference (blank — no RFC cited in IANA registry); assignee Jarkko Oikarinen; dual-registered 194/tcp + 194/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed] — port 194 < 1024
- Registration/modification dates
- blank in the IANA registry (no published dates — do not fabricate) [Confirmed] — IANA the IANA Service Name and Transport Protocol Port Number Registry
- Related ports
- 194/tcp (same
ircassignment); the de-facto IRC cluster 6660–6669/tcp and 7000/tcp; 6697/tcp (IRC over TLS, RFC 7194)
Primary use
IANA-assigned to IRC, but no meaningful UDP usage; IRC is a TCP-oriented plaintext chat protocol and the 194/udp row mirrors the TCP assignment
Other/unofficial uses
none documented on UDP; real-world IRC runs on 6667/tcp (plaintext) and 6697/tcp (TLS)
Security implications
negligible practical exposure on 194/udp — no legitimate software or malware documented on this port/transport; IRC C2 historically used 6667/tcp or custom high ports; unexpected 194/udp traffic is anomalous and worth investigating but is not a known active attack surface
Typically seen on
effectively nothing on UDP; any response is an anomaly / possible decoy
- Why 194 is unused
- it is a privileged port (<1024), so binding requires root; the IRC community standardized on the unprivileged 6667/tcp instead [Likely] — verylazytech IRC ports reference, Wikipedia (IRC)
- Analyst note
- A response on 194/udp is statistically rare and has no documented legitimate use — treat unexpected traffic as anomalous and investigate; do not assume a normal IRC service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| irc | UDP | Internet Relay Chat Protocol | 0.06% |
| irc | TCP | Internet Relay Chat | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.