204

Port 204/tcp is registered with IANA under the service name at-echo, described simply as "AppleTalk Echo." The registry entry is dual-registered — an identical row exists for 204/udp with the same service name and description — and every field past the description (assignee, contact, registration date, modification date, reference, service code, unauthorized-use-reported, assignment notes) is blank in the current registry, so those are recorded here as sourced nulls rather than guesses. The service corresponds to the AppleTalk Echo Protocol (AEP), a simple reachability/echo-test mechanism used within Apple's AppleTalk networking stack, which shipped in classic Mac OS and carried into early Mac OS X. No RFC or IANA reference document is cited for it, which is consistent with AppleTalk's origins as an Apple-proprietary protocol suite rather than an IETF-standardized one. AppleTalk itself was formally deprecated by Apple starting with Mac OS X 10.6 "Snow Leopard," released August 28, 2009, after which the protocol stack was removed from mainstream Apple operating systems. As a result, port 204 is not expected to appear as an actively used service on modern internet-facing hosts; a response on this port today would most plausibly come from legacy AppleTalk-era equipment, an AppleTalk-to-IP bridge/emulation layer, or an unrelated service that happens to bind the same number. No confirmed malware association was located for this specific port, and no first-party scan-engine exposure dashboard covers it; the nmap-services dataset does carry a measured open-frequency, and it is minute — about 0.000025 for 204/tcp, roughly 2 to 3 in 100,000 scanned hosts, against about 0.000412 on the UDP side, which measures how often the port number was found open rather than any surviving AppleTalk Echo service.

IANA assignment

at-echo — "AppleTalk Echo"; reference blank; assignee/contact blank; dual-registered 204/tcp + 204/udp with identical entries [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry / .txt)

Range class

well-known (0–1023) [Confirmed]

Prevalence / exposure scanning

nmap-services observed open-frequency 204/tcp ≈ 0.000025 (very low — roughly 2 to 3 in 100,000 scanned hosts in the nmap-services sample); the dual-registered 204/udp side is higher at ≈ 0.000412 [Confirmed] — nmap-services dataset. The figure records scan-observed openness on the port number, not surviving AppleTalk Echo traffic; no first-party (IANA, CISA, major scan-engine) exposure statistics for this port were found [Unknown]

Related ports

none confirmed in this research pass [Unknown]

Primary use

AppleTalk Echo Protocol (AEP) — echo/reachability testing on AppleTalk networks; no RFC or IANA reference document is listed for it

Malware association

no confirmed malware/Trojan association found; a single secondary, non-authoritative source explicitly reports none known, which is treated as no-evidence-found rather than a verified clean bill given it is single-sourced

Typically seen on

legacy AppleTalk-era Apple/Mac network equipment (pre-2009); essentially obsolete on modern networks [Likely]

Historical context

AppleTalk shipped in classic Mac OS and early Mac OS X; Apple discontinued AppleTalk support starting with Mac OS X 10.6 "Snow Leopard" (released August 28, 2009) [Confirmed] — https://thisdayintechhistory.com/08/28/snow-leopard-released-the-end-of-appletalk/ , https://www.computerhistory.org/tdih/august/28/ , https://en.wikipedia.org/wiki/AppleTalk

Port 204/udp is registered with IANA under the service name at-echo, described simply as "AppleTalk Echo." The registry entry is otherwise sparse — no assignee, no contact, no registration or modification date, and no RFC/reference are listed in the IANA Service Name and Transport Protocol Port Number Registry; those fields are genuinely blank in the source, not omitted or unresearched. Port 204 is dual-registered: 204/tcp carries the identical service name and description with the same blank metadata columns. The underlying service is AEP, the AppleTalk Echo Protocol, part of Apple's pre-TCP/IP AppleTalk networking suite from the 1980s. AEP works much like ICMP echo/ping does for IP: a node sends a packet to another node's fixed "echoer" socket (socket 4) and expects the identical payload echoed back, letting administrators or client software test reachability across an AppleTalk internet rather than an IP one. AppleTalk as a whole is a long-obsolete, effectively retired protocol suite with no meaningful footprint in modern networks or software stacks. No CVEs, published exploits, or documented scanning campaigns specifically targeting at-echo or port 204 turned up in CVE Details or NVD searches during this pass. For a contemporary analyst, a host answering on 204/udp today is far more likely to be an unrelated custom service, a misconfiguration, or a rare legacy holdout than an active AppleTalk deployment, and is worth investigating rather than assuming benign.

IANA assignment

at-echo — "AppleTalk Echo"; Reference column blank (no RFC cited); Assignee/Contact/Registration Date/Modification Date all blank in source; dual-registered 204/tcp + 204/udp with identical blank metadata [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 495 (local cached IANA Service Name and Transport Protocol Port Number Registry); cross-checked against https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 204/udp ≈ 0.000412 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 204/tcp side is rarer at ≈ 0.000025 [Confirmed] — nmap-services dataset

Primary use

AEP (AppleTalk Echo Protocol) — an echo/reachability test on AppleTalk's fixed "echoer" socket (socket 4), functionally analogous to ICMP echo but for the legacy AppleTalk internet

Historical/RFC context

AppleTalk management-object MIBs were documented in RFC 1243 (1991), later obsoleted by RFC 1742 (1994); these describe AppleTalk MIB objects generally, not the at-echo port assignment itself — IANA's own Reference field for this entry stays blank, so no RFC is attributed as the port's registration reference

[Likely] — https://datatracker.ietf.org/doc/html/rfc1243, https://www.rfc-editor.org/rfc/rfc1742.html

Deprecation/exposure

AppleTalk is an obsolete, largely retired protocol suite; no CVEs, exploits, or scanning writeups tying to at-echo or port 204 were found in CVE Details or NVD searches during this pass [Likely] — https://www.cvedetails.com/vulnerability-list.php?vendor_id=0&product_id=0&version_id=0&page=526, https://nvd.nist.gov/vuln/detail/CVE-2019-19227

Common/modern software

Unknown — no specific current product or codebase ties itself to port 204 in sources checked; historical implementers were classic Mac OS AppleTalk stacks and period AppleTalk-capable routers/print servers [Unknown]

Analyst note

a modern host responding on 204/udp is more plausibly an unrelated/mislabeled custom service than genuine legacy AppleTalk, given AppleTalk's near-total retirement — this is the research pass's own inference, not a directly sourced finding

[Likely, inference] — synthesized from the AppleTalk-deprecation and no-CVE findings above