197

Port 197 is registered with IANA under the service name dls, described simply as "Directory Location Service," and the registration is dual — the identical service name, description, and blank metadata appear on both the TCP and UDP rows of the IANA Service Name and Transport Protocol Port Number Registry. The registry entry is otherwise sparse: there is no assignee listed, no contact, no registration or modification date, and critically no RFC or other reference document cited, so nothing beyond the bare name-and-description pairing can be confirmed about the protocol's design or history. "Directory Location Service" strongly suggests an early network-directory or name-resolution helper (in the spirit of X.500-era or NIS-adjacent directory lookups common when the low port-number space was being allocated), but no surviving specification, vendor implementation, or historical write-up could be located to substantiate that inference, so it is treated here as informed speculation rather than fact. In current practice the port sees essentially no legitimate use: no modern software product or service is known to bind port 197 by default, and it does not appear in any well-known service stack's documentation. It does show up passively in general internet background-scanning telemetry (as most ports in the well-known range do), but that reflects broad internet-wide port sweeps rather than any evidence of the service being actively deployed or targeted. No dated CVE or named malware campaign is tied to this port. For an analyst, a live listener on 197/tcp today is unusual enough to warrant investigation as a custom or legacy application rather than assumption of the registered IANA use.

IANA assignment

dls — "Directory Location Service"; reference blank (no RFC cited); assignee blank; dual-registered 197/tcp + 197/udp with identical name/description [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-481; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

Range class

well-known (0–1023) [Confirmed]

Prevalence / exposure notes

appears in general internet background-scanning telemetry (e.g., SANS ISC's tracked port list) consistent with broad, non-targeted internet-wide sweeps rather than active deployment; a generic "historical trojan/virus" disclaimer appears on some third-party port-lookup sites but is applied broadly across many ports and is not tied to a specific dated incident for 197 [Likely/Low-confidence for the malware flag] — https://isc.sans.edu/port.html?port=197; https://www.auditmypc.com/tcp-port-197.asp

Related ports

none specifically documented as related; contrast with modern directory/naming services (e.g., LDAP 389, DNS 53)

Primary use

registered as a directory-location lookup service per IANA name/description; no protocol specification or RFC is cited, so the underlying wire format is Unknown [Likely — name/description only, no spec found]

Other/unofficial uses

none verifiable; no modern software or vendor is documented as using this port [Unknown]

Security implications

no named CVE or documented malware campaign found for this port; an open 197/tcp today would be atypical and merits investigation as custom/legacy software rather than the registered directory service [Unknown for specific threats; Likely for general anomaly framing]

Typically seen on

no known modern hosts by default; would be anomalous if observed

Analyst note

registry data for 197 is thin (no assignee, date, or reference) — treat the "Directory Location Service" name as the extent of confirmed fact and flag any live listener for manual investigation.

Port 197/udp is registered with IANA under the service name dls, described simply as "Directory Location Service." The entry is dual-registered: both 197/tcp and 197/udp carry the identical service name and description, with no distinguishing text separating the two transports. Beyond the bare name and description, the cached IANA registry row for this port has every other column blank — no assignee, no contact, no registration or modification date, and no RFC or other reference. That blank reference field is itself informative: it means there is no defining specification tying "dls" to a documented wire protocol, which distinguishes it from ports whose registry entries point to an RFC. A companion lookup of the adjacent port (198/udp, "dls-mon" — Directory Location Service Monitor, historically associated with a contact named Scott Bellew) suggests 197 and 198 were registered together as a small, informal pairing — a directory-location service and its monitoring counterpart — rather than as part of a widely adopted protocol family. No current vendor documentation, defining specification, or common software was identified that actively implements or defaults to UDP/197 today, and a port-reputation check found no malware or trojan association, though that check is a shallow signal rather than a scan-prevalence measurement. Overall this reads as a legacy, lightly documented IANA registry entry rather than an actively used or well-specified service.

IANA assignment

service name dls, description "Directory Location Service"; dual-registered 197/tcp and 197/udp with identical name/description; assignee, contact, registration date, modification date, reference, service code, unauthorized-use-reported, and assignment-notes columns are all blank in the registry [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 481); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

IANA reference/RFC

none listed — blank column, no defining specification found [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 481); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023)

Common software

none identified in this pass that defaults to or is known to use UDP/197 [Unknown]

Typically seen on

no confirmed deployment pattern identified; treat an open 197/udp as anomalous/legacy rather than expected [Unknown]

Related port

198/tcp+udp = dls-mon (Directory Location Service Monitor), historically listed with contact Scott Bellew — suggests 197/198 were registered as a paired service+monitor [Confirmed] — http://www.t1shopper.com/tools/port-number/198/

Primary protocol/use

no defining spec or vendor documentation located describing an actual DLS wire protocol; appears to be a legacy/reserved registry entry rather than an actively specified or implemented protocol

[Unknown] — https://www.speedguide.net/port.php?port=197; https://svn.nmap.org/nmap-releases/nmap-7.30/nmap-services

Security exposure

a port-reputation checker reports no known virus/trojan association for UDP/197; no CVEs or active-exploitation reports found tied to this port or service name; on scan prevalence, the nmap-services dataset puts the open-frequency for dls on 197/udp at 0.000659 (~0.07% of sampled hosts) with 0.000000 on 197/tcp, so exposure is measurable but rare

[Likely] — https://www.auditmypc.com/udp-port-197.asp ; nmap-services dataset