200
Summary
- // if you see it open
- No authoritative dated advisory or CVE specifically tied to 200/tcp was found. Secondary port-lookup sources frame it as sensitive if exposed, since it permits remote AIX subsystem control, but this is not confirmed by a primary security source — treated as plausible context, not fact.
- // analyst note
- an externally reachable 200/tcp is a strong AIX fingerprint and an administrative-control surface; verify it is restricted to trusted management networks.
About port 200/tcp.
Port 200/tcp is registered with IANA under the service name src, described as "IBM System Resource Controller." The assignment is dual-registered — an identical row also exists for 200/udp — and both share the same assignee/contact field, [Gerald_McBrearty]. As is common for many older IANA port registrations, the registry's Registration Date, Modification Date, Reference (RFC), Service Code, Unauthorized Use Reported, and Assignment Notes columns are all blank for this entry; no RFC or dated registration event is published, so none is invented here. In practice, port 200 is the well-known port used by IBM AIX's System Resource Controller subsystem, specifically the srcmstr master daemon, which lets administrators and management tools remotely start, stop, and query AIX subsystems and subservers (the commands startsrc, stopsrc, and lssrc are the local-CLI face of the same subsystem). This is a platform-specific, IBM-proprietary control-plane service rather than a general-purpose or cross-platform protocol — it is not found on Linux, BSD, Windows, or other mainstream Unix variants outside the AIX ecosystem. No authoritative, dated security advisory (CERT/NVD/vendor bulletin) specifically documenting scanning campaigns, malware, or a named CVE tied to 200/tcp was located in this pass; secondary port-lookup sites describe generic risk framing (a remotely reachable daemon-control service is inherently sensitive if exposed to untrusted networks) but are not primary sources, so that framing is noted as plausible context rather than a confirmed fact. Given its narrow AIX-specific role, an analyst encountering an open 200/tcp externally should treat it as a strong signal of an AIX host and, if remotely reachable from outside a trusted management network, worth flagging for restriction to internal/admin-only access.
- IANA assignment
src— "IBM System Resource Controller"; reference blank; assignee/contact[Gerald_McBrearty]; dual-registered 200/tcp + 200/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (local cached copy of https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)- Registration/modification date, IANA reference (RFC), service code, unauthorized-use-reported, assignment notes
- all blank in the source registry — not fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
- Range class
- well-known (0–1023) [Confirmed]
Primary use
AIX System Resource Controller master daemon (srcmstr) — remote start/stop/status of AIX subsystems via startsrc/stopsrc/lssrc
Common software
IBM AIX srcmstr; platform-specific, not present on Linux/Windows/BSD mainstream builds
Typically seen on
IBM AIX hosts running System Resource Controller-managed subsystems [Likely]
- Security/exposure notes
- no authoritative dated advisory or CVE found specifically for 200/tcp in this pass; secondary port-lookup sites frame it as sensitive-if-exposed due to remote daemon control, but this is not a primary-source-confirmed fact[Unknown] — https://www.auditmypc.com/tcp-port-200.asp, https://www.connected.app/he/ports/200
- Analyst note
- an externally reachable 200/tcp is a strong AIX fingerprint and an administrative-control surface; verify it is restricted to trusted management networks.
About port 200/udp.
Port 200/udp is registered with IANA under the service name src, described as "IBM System Resource Controller," with assignee Gerald_McBrearty and a blank Reference field — no RFC or other document is cited for this assignment, and no registration or modification date is on file, so both are honestly reported as unknown rather than filled with a placeholder. The registry also carries a dual registration: 200/tcp is assigned to the same service name and description directly adjacent to the udp entry, indicating the assignment was made for both transports together rather than udp alone. Functionally, this port ties to IBM AIX's System Resource Controller subsystem, whose master daemon srcmstr manages the starting, stopping, and status-tracking of AIX subsystems and subservers (the equivalent of startsrc/stopsrc/lssrc). By default srcmstr does not accept remote requests; AIX administrators can optionally launch it with a -r flag to allow remote administrative control, and this port is the channel such remote control would use. No CVE, exploit, or scan-telemetry source documenting real-world exposure of 200/udp was located in this pass, so prevalence and abuse data are reported as unverified rather than invented.
- IANA assignment
src— "IBM System Resource Controller"; reference (blank — no RFC cited); assignee Gerald_McBrearty; dual-registered 200/tcp + 200/udp [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt (corroborated by local cached copy of the same registry, the IANA Service Name and Transport Protocol Port Number Registry line 487, tcp counterpart line 486)- Registration/modification date
- Unknown — the IANA registry entry for this legacy port carries no date field; not fabricated [Confirmed absence] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
- Range class
- well-known (0–1023) [Confirmed]
- Prevalence / exposure
- nmap-services observed open-frequency 200/udp ≈ 0.000626 — very low (roughly 6 in 10,000 scanned hosts in the nmap-services sample); the paired 200/tcp row is far rarer at ≈ 0.000025 [Confirmed] — nmap-services dataset. That very low figure is consistent with the third-party port-info aggregator's claim that the port is rarely seen exposed in modern environments and should be firewalled from untrusted networks, though that source remains secondary and unverified [Likely] — https://www.connected.app/he/ports/200. No Shodan or Censys source with 200/udp-specific exposure counts was found in this pass [Unknown]
- Related ports
- 200/tcp (same
srcservice name, dual registration); no further related-port set could be confirmed [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
Primary use
remote-control channel for IBM AIX's System Resource Controller (SRC) subsystem-management facility; srcmstr can optionally run with -r to accept remote start/stop/status requests over this port, but does not by default [Likely] — https://www.ibm.com/docs/en/aix/7.2.0?topic=administration-system-resource-controller ; https://groups.google.com/g/comp.unix.aix/c/B0gy4cColKo
Common software
IBM AIX srcmstr daemon — platform-specific to AIX; not associated with Linux/Windows/other Unix under this port
Malware associations
none identified in this pass [Unknown]
- Analyst note
- an open 200/udp is not part of any documented default-on posture in mainstream OSes; it plausibly indicates AIX SRC remote administration deliberately enabled, and should be evaluated as a configuration/exposure finding rather than assumed malicious.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| src | UDP | IBM System Resource Controller | 0.06% |
| src | TCP | IBM System Resource Controller | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.