205

Port 205/tcp is registered with IANA under the service name at-5 and the description "AppleTalk Unused," with a matching dual registration on 205/udp carrying the identical name and description. Every other registry column for this row — assignee, contact, registration date, modification date, and RFC/reference — is blank in the IANA Service Name and Transport Protocol Port Number Registry, so no first-party authorship or dating information exists to report. The at-* naming pattern places port 205 inside a consecutive block of AppleTalk-related registrations running roughly from 201 through 208 (for example 201=at-rtmp, 202=at-nbp, 204=at-echo), most of which were reserved for specific pieces of the AppleTalk protocol suite; 205's "Unused" description indicates IANA held the slot in that block without ever assigning it to an active sub-protocol. AppleTalk itself was Apple's proprietary local-area networking stack, phased out starting with Mac OS X 10.6 in 2009 and effectively absent from modern networks and operating systems. No vendor documentation, malware family, or dated CVE was found tying live software to this port, which is consistent with it never having carried real traffic. Because the port sits in a dead, historically single-vendor protocol family with no registrant metadata and no known software binding it, an analyst who sees 205/tcp respond on a scan should treat it as noteworthy — most plausibly generic port-scan noise, a honeypot/decoy response, or a misconfigured listener rather than a legitimate AppleTalk service, since AppleTalk has had no meaningful installed base for well over a decade.

IANA assignment

at-5 — "AppleTalk Unused"; reference field blank; assignee/contact/registration date/modification date all blank; dual-registered 205/tcp + 205/udp with identical name and description [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, lines 496-497; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Range class

well-known (0–1023)

Related ports

the adjacent AppleTalk at-* block (201 at-rtmp, 202 at-nbp, 204 at-echo, and other 20x entries); the 205/udp twin of this same registration

Primary use

none — IANA describes the assignment itself as "Unused"; no active AppleTalk sub-protocol was ever bound to this port

Protocol family context

sits inside a consecutive block of AppleTalk at-* registrations (approx. 201–208, e.g. 201=at-rtmp, 202=at-nbp, 204=at-echo); AppleTalk was deprecated by Apple starting Mac OS X 10.6 (2009) and is effectively obsolete today

Common software

Unknown — no vendor documentation, service banners, or software found binding to 205/tcp or 205/udp, consistent with the port's Unused status [Unknown]

Exposure/scanning notes

Unknown — no dated CVEs, incident reports, or scan-telemetry writeups specific to this port were found; any observed response today is more plausibly generic scan noise or a decoy than a live service, but this is an inference rather than a directly sourced claim [Unknown]

Typically seen on

no known legitimate host type; treat a response as an anomaly given AppleTalk's obsolescence

Analyst note

A registered-but-unused, dead-protocol-family port with no registrant metadata; an open 205/tcp is unusual and warrants investigation as noise, a decoy, or a misconfiguration rather than assumption of legitimate AppleTalk use.

Port 205/udp is registered with IANA under the service name at-5 with the description "AppleTalk Unused"; the assignee, contact, registration date, modification date, and reference (RFC) fields are all blank in the registry, and 205/tcp carries the identical at-5 / "AppleTalk Unused" entry as a dual registration. Port 205 sits inside the small cluster of ports IANA reserved for AppleTalk's Datagram Delivery Protocol (DDP) well-known sockets — neighbors include at-rtmp (201, routing table maintenance), at-nbp (202, name binding), at-3 (203), at-echo (204), and at-zis (206, zone information). Unlike those siblings, port 205 was never assigned a concrete sub-protocol; IANA's own label is literally "Unused." AppleTalk as a whole was deprecated by Apple and removed from Mac OS X with the release of Snow Leopard on August 28, 2009, in favor of Bonjour/IP-based networking, and as of June 2026 the mainline Linux kernel dropped its legacy AppleTalk (ddp/atalk) subsystem entirely, with maintainers citing it as unmaintained code that had become a magnet for low-quality patches rather than genuine usage. No modern application, service, or malware family is documented as using UDP port 205 for legitimate traffic. nmap's internet-scan-derived port-frequency data shows the port open essentially never in practice, consistent with a long-defunct, reserved-but-never-defined legacy slot; any unsolicited traffic on it today is best read as scan noise or an anomaly rather than a targeted exploit of a known service.

IANA assignment

at-5 — "AppleTalk Unused"; assignee, contact, registration date, modification date, and reference fields all blank [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=205 ; the IANA Service Name and Transport Protocol Port Number Registry, line 497

Range class

well-known (0–1023) [Confirmed] — same IANA registry entry

Dual registration

205/tcp carries the identical at-5 / "AppleTalk Unused" entry (registry CSV line 496) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Prevalence

nmap-services open-frequency 205/udp ≈ 0.000890, 205/tcp ≈ 0.000013 (rarely if ever seen open) [Likely] — https://svn.nmap.org/nmap/nmap-services

IANA reference (RFC)

blank in the registry; left blank, not inferred [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=205

Protocol context

reserved-but-never-defined slot in the AppleTalk DDP well-known-socket range (201–206), alongside at-rtmp, at-nbp, at-3, at-echo, and at-zis

Malware association

none documented; third-party port database flags UDP 205 "Virus/Trojan: No"

AppleTalk deprecation

removed from Mac OS X in Snow Leopard, released August 28, 2009 [Confirmed] — https://thisdayintechhistory.com/08/28/snow-leopard-released-the-end-of-appletalk/

AppleTalk removal from Linux

mainline kernel dropped the ddp/atalk subsystem in June 2026, cited as unmaintained and a target of low-quality AI-generated patches [Confirmed] — https://www.privacyguides.org/news/2026/06/18/linux-removes-support-for-legacy-appletalk-protocol-in-response-to-ai-patches/

Common/current software

none documented using UDP 205 for legitimate traffic in 2026 [Likely] — https://www.privacyguides.org/news/2026/06/18/linux-removes-support-for-legacy-appletalk-protocol-in-response-to-ai-patches/

Security context

no legitimate live use case since AppleTalk's removal from macOS (2009) and Linux (2026); unsolicited traffic is most plausibly scan noise, a misconfigured legacy device, or incidental probing rather than a known-service exploit; no CVEs specific to this port found

[Likely] — https://en.wikipedia.org/wiki/AppleTalk ; https://www.auditmypc.com/udp-port-205.asp