201

Port 201/tcp is registered with IANA as at-rtmp with the description "AppleTalk Routing Maintenance" and a blank reference field (dual-registered on TCP and UDP). It is the well-known port assigned to AppleTalk's Routing Table Maintenance Protocol (RTMP) within the classic Mac AppleTalk-over-IP suite, and it heads the contiguous AppleTalk block of ports 201–208 (at-rtmp, at-nbp, at-3, at-echo, at-5, at-zis, at-7, at-8). RTMP is a distance-vector routing protocol: AppleTalk routers broadcast their routing tables roughly every ten seconds so peers learn reachable networks and adapt to topology changes, using a hop-count metric with a maximum of 15 hops. It is documented in the AppleTalk MIBs (RFC 1243, 1991; RFC 1742, 1995) and was superseded for WAN use by AURP (RFC 1504, 1993). The IANA reference field is blank. A critical disambiguation: this is AppleTalk's Routing Table Maintenance Protocol, not Adobe's Real-Time Messaging Protocol (RTMP), which uses TCP 1935. Security-wise, the protocol is obsolete with effectively zero modern internet footprint — Apple removed AppleTalk support in Mac OS X 10.6 (2009) — and while legacy AppleTalk had broadcast-heavy, unauthenticated routing with the usual spoofing and route-injection risks, it is irrelevant on modern networks. For an analyst, an open 201/tcp today almost always indicates a misidentified service or a relic AppleTalk router/bridge, so it should be treated as legacy cleanup rather than a live threat.

IANA assignment

at-rtmp — "AppleTalk Routing Maintenance"; reference (blank — no RFC cited in IANA registry); dual-registered 201/tcp + 201/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low/negligible open-frequency in nmap-services (de-facto) [Well-established] — nmap-services file

Related ports

202–208 (rest of the AppleTalk suite); contrast 1935 (Adobe RTMP)

Primary use

AppleTalk Routing Table Maintenance Protocol (RTMP); obsolete

Other/unofficial uses

none today [Well-established]

Security implications

obsolete AppleTalk; broadcast-heavy unauthenticated routing historically; irrelevant on modern networks (AppleTalk removed in Mac OS X 10.6, 2009) [Well-established]

Typically seen on

legacy Macs/AppleTalk routers; otherwise misidentified

Analyst note

An open 201/tcp almost always indicates a misidentified service or a relic AppleTalk router/bridge; treat as legacy cleanup, not a live threat. NOT Adobe RTMP (1935).

Port 201/udp is registered with IANA as at-rtmp with the description "AppleTalk Routing Maintenance" and a blank reference field; the identical service name and description also appear on 201/tcp, so the assignment is dual-registered across both transports. This is the well-known port for AppleTalk's Routing Table Maintenance Protocol (RTMP), the distance-vector routing protocol classic AppleTalk routers used to exchange reachability information: routers broadcast their routing tables roughly every ten seconds so peers can learn about reachable networks and adapt to topology changes, using a hop-count metric capped at 15 hops. The protocol is documented informally via the AppleTalk MIBs (RFC 1243, 1991; RFC 1742, 1995) and was superseded for wide-area use by AURP (RFC 1504, 1993); none of these RFCs is cited as the IANA reference for the port assignment itself, which remains genuinely blank in the registry rather than an omission. A key disambiguation: this is AppleTalk's Routing Table Maintenance Protocol, unrelated to Adobe's Real-Time Messaging Protocol — also abbreviated RTMP — which runs over TCP 1935. Classic AppleTalk network-layer traffic, including RTMP, rode over DDP within the native AppleTalk stack rather than as ordinary UDP/IP application traffic, so the UDP registration functions primarily as a formal IANA port-number reservation. Apple removed AppleTalk protocol support from Mac OS X starting with 10.6 Snow Leopard (2009), so no current first-party software binds this port; as a UDP service an unsolicited probe typically draws no response, so internet-wide scanners generally show near-zero live results, and any hit is far more likely to be scanner noise or a misconfigured service than genuine legacy AppleTalk traffic. This 201/udp research is fully consistent with the already-researched sibling entry /port/201/.

IANA assignment

at-rtmp — "AppleTalk Routing Maintenance"; port 201/udp; reference blank in registry [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

IANA reference field

blank for both TCP and UDP rows — not fabricated, left blank per registry [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Primary use

AppleTalk Routing Table Maintenance Protocol (RTMP) — distance-vector routing for classic AppleTalk networks, ~10s broadcast interval, hop-count max 15; documented via AppleTalk MIBs, not cited as the port's own IANA reference

Other/unofficial uses

none in modern practice; no current software binds this port since AppleTalk removal in Mac OS X 10.6 (2009) [Well-established]

Exposure/scanning notes

UDP closed-port probes typically draw no response; near-zero live scan results expected; any hit is likely misconfiguration or scanner noise rather than genuine AppleTalk traffic (DDP-vs-UDP/IP architecture distinction)

Dual-registration

identical service name/description on 201/tcp (line 488) and 201/udp (line 489) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-489

Disambiguation

AppleTalk RTMP (this port) is unrelated to Adobe's Real-Time Messaging Protocol, which uses TCP 1935 [Well-established]

Sibling consistency

matches the already-researched 201/tcp entry (same IANA description, blank reference, dual-registration) with no contradictions [Confirmed] — /port/201/