199

Port 199/tcp is registered with IANA as smux with the description "SMUX," assignee Marshall Rose, and a blank reference field (dual-registered on TCP and UDP). SMUX is the SNMP Multiplexing protocol, defined in RFC 1227 (May 1991, M. Rose): a user process — a SMUX peer — opens a SMUX association over TCP 199 to the local SNMP agent, registers a MIB subtree, and thereafter fields management operations for objects in that subtree, with a simple two-phase commit for atomic SET operations. The point is to generalize the SNMP agent so that non-core MIBs can be served by separate processes, for example to instrument a binary-only operating system component. The IANA reference field is blank. SMUX is an older alternative to AgentX (RFC 2741, port 705) and is largely superseded by it, though it persists in legacy Unix deployments such as net-snmp's smux support and IBM's xmservd; notably, although the SMUX OpenPDU includes a password field, a zero-length value indicates no authentication. Security-wise, an open SMUX on 199 is mainly a reconnaissance signal that the host is an SNMP-managed Unix system, which draws attention to the adjacent SNMP attack surface on 161/162 — weak community strings, information disclosure, and the SMUX peer's optional or weak authentication. For an analyst, an open 199 effectively marks a Unix host running net-snmp (or similar) with SMUX enabled, often alongside 161; harden or disable SMUX if it is unused and lock down the host's SNMP configuration.

IANA assignment

smux — "SMUX"; reference (blank — no RFC cited in IANA registry); assignee Marshall Rose; dual-registered 199/tcp + 199/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low-to-moderate; nmap-services open-frequency ~0.0159 (de-facto) [Well-established] — nmap-services file

Related ports

161/162 (snmp/snmptrap), 705 (agentx — the modern replacement), 153/160 (sgmp); 199/udp sibling

Primary use

SNMP subagent multiplexing over TCP 199 (RFC 1227)

Other/unofficial uses

legacy net-snmp/smux, IBM xmservd [Well-established]

Security implications

recon signal for an SNMP-managed Unix host; draws attention to 161/162 SNMP surface (weak communities, disclosure); SMUX peer auth optional/weak (zero-length password = none)

Typically seen on

Unix hosts running net-snmp with SMUX enabled

Analyst note

An open 199 ≈ a Unix host running net-snmp with SMUX enabled; harden/disable SMUX if unused and lock down SNMP. Often appears alongside 161.

Port 199/udp is registered with IANA as smux, described simply as "SMUX," with both the assignee and contact fields listed as [Marshall_Rose]; the Registration Date, Modification Date, and IANA Reference columns are blank in the registry, and the entry is dual-registered alongside 199/tcp under the identical service name and contact. SMUX (SNMP Unix Multiplexer) is defined in RFC 1227 (M. Rose, May 1991), a historic/experimental-status specification that lets a user-space SNMP sub-agent process open a connection to a host's local SNMP master agent, register the MIB subtrees it manages, and have matching SNMP requests forwarded to it by the master agent — port 199 was the well-known rendezvous point for that handshake. The protocol has been functionally superseded by AgentX (RFC 2741, 1999), the modern SNMP sub-agent multiplexing mechanism, making SMUX legacy today. The best-documented real-world implementation is Net-SNMP (formerly UCD-SNMP), whose snmpd can open TCP 199 as an SMUX listener purely from configuration, independent of whether a sub-agent is actually connected — a documented quirk rather than a vulnerability. SMUX's native authentication (a simple shared string per RFC 1227) is weak by 1991-era design, so a reachable SMUX listener could in principle accept an unauthenticated or weakly authenticated peer able to register or alter MIB data surfaced through the master agent; this is a structural protocol property, not a specific CVE. No genuine CVE or dated exposure count for the SMUX protocol/port itself could be verified in this pass — several low-quality "port exploit" pages attribute CVE-2020-15862 and CVE-2019-12591 to SMUX/port 199, but neither actually corresponds to SMUX (the former is an unrelated Net-SNMP EXTEND MIB privilege-escalation issue; the latter maps to an unrelated product per NVD), and an undated 2022 "authentication bypass" anecdote has no traceable source — these are rejected rather than recorded as fact.

IANA assignment

smux — "SMUX"; assignee/contact [Marshall_Rose]; Registration Date, Modification Date, and IANA Reference columns blank; dual-registered 199/tcp + 199/udp [Confirmed] — local IANA registry CSV (the IANA Service Name and Transport Protocol Port Number Registry, line 485 udp / line 484 tcp)

Range class

well-known (0–1023) [Confirmed]

Related ports

199/tcp (dual registration, identical smux service); contrast 705/tcp AgentX (modern successor protocol) [Likely]

Primary use

SNMP Unix Multiplexer protocol per RFC 1227 (M. Rose, May 1991); lets an SNMP sub-agent register MIB subtrees with a local master agent over TCP/UDP port 199

Protocol status

historic/experimental, functionally superseded by AgentX (RFC 2741, 1999)

Other implementations

legacy/proprietary Unix SNMP agent SDKs reference SMUX (e.g., SCO/Xinuos SDK docs)

Security implications

native authentication is a simple shared string (RFC 1227); weak by design, so a reachable listener could allow an unauthenticated/weakly authenticated peer to register or alter MIB data — a structural property, not a specific CVE

Exposure/scanning prevalence

Unknown — no dated Shodan/Censys count or nmap-services open-frequency figure was located for 199/udp in this pass [Unknown]

Common implementation

Net-SNMP (formerly UCD-SNMP) snmpd can open TCP 199 as an SMUX listener purely via configuration, regardless of an actual connected sub-agent [Likely] — https://bugzilla.redhat.com/show_bug.cgi?id=110931

Unverified/rejected claims

third-party "port-exploit" pages attribute CVE-2020-15862 and CVE-2019-12591 to SMUX/port 199; neither corresponds to SMUX per NVD (former is an unrelated Net-SNMP EXTEND MIB issue, latter maps to an unrelated product); an undated 2022 "authentication bypass" anecdote has no traceable source — not recorded as fact [Confirmed] — https://www.pentestpad.com/port-exploit/port-199-smux-snmp-multiplexing-protocol, https://nvd.nist.gov/vuln/detail/CVE-2020-15862, https://nvd.nist.gov/vuln/detail/CVE-2019-12591