206

Port 206/tcp is registered with IANA as at-zis, "AppleTalk Zone Information," and is dual-registered on 206/udp with the identical service name and description; the Assignee, Contact, Registration Date, Modification Date, and Reference columns are all blank in the current IANA registry — nothing is fabricated to fill those gaps. This socket is the Zone Information Socket (ZIS) used by AppleTalk's Zone Information Protocol (ZIP), one of a cluster of well-known DDP (Datagram Delivery Protocol) sockets that Apple's networking stack reserved in the low-200s range in the late 1980s, alongside neighbors such as at-nbp and at-echo. ZIP lets AppleTalk routers exchange and answer queries about which zone names map to which network numbers: a router issues a ZIP Query listing network numbers it wants zone names for, and the receiving router answers with a ZIP Reply. AppleTalk itself was Apple's proprietary LAN protocol suite used by classic Mac OS, early Mac OS X, AppleTalk-capable routers, and LaserWriter print servers; Apple deprecated and removed client-side AppleTalk support starting with Mac OS X 10.6 Snow Leopard in 2009, so the protocol — and any legitimate use of port 206 — has been effectively absent from production networks for well over a decade. No CVE or malware association with TCP/UDP 206 turned up in this research pass, and because the protocol is functionally extinct, a live response on 206/tcp today is more plausibly legacy equipment, a coincidental unrelated service, or a scanning artifact than active AppleTalk traffic. The measured footprint backs that up: the nmap-services dataset records an observed open-frequency of about 0.000025 for 206/tcp, roughly 2 to 3 in 100,000 scanned hosts, against about 0.000956 on the UDP side — a figure that counts how often the port number was found open, not confirmed ZIP traffic.

IANA assignment

at-zis — "AppleTalk Zone Information"; Reference (blank — no RFC cited in IANA registry); Assignee/Contact/Registration Date/Modification Date all blank; dual-registered 206/tcp + 206/udp [Confirmed] — cached the IANA Service Name and Transport Protocol Port Number Registry (lines 498-499) and https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 206/tcp ≈ 0.000025 (very low — roughly 2 to 3 in 100,000 scanned hosts in the nmap-services sample); the dual-registered 206/udp side is markedly higher at ≈ 0.000956, expected given ZIP runs over DDP/datagrams [Confirmed] — nmap-services dataset. The figure records scan-observed openness on the port number, not confirmed AppleTalk ZIP traffic [Confirmed]

Related ports

neighboring AppleTalk DDP well-known sockets at-nbp (202) and at-echo (204) [Likely] — https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Primary use

Zone Information Socket (ZIS) for AppleTalk's Zone Information Protocol (ZIP), which runs over DDP so routers can query/exchange network-number-to-zone-name mappings [Likely] — https://obsoletemadness.github.io/Inside-AppleTalk/books/inside-appletalk-second-edition/08-zone-information-protocol.html, http://www.employees.org/univercd/Feb-1998/CiscoCD/cc/td/doc/product/software/ssr90/rpc_r/54049.htm

Other/unofficial uses

none documented in this pass [Unknown]

Security implications

no CVE or malware/trojan association found for TCP/UDP 206 in this pass [Unknown]; the near-zero exposure reading rests on the nmap-services open-frequency (≈ 0.000025 tcp) plus AppleTalk's 2009 client deprecation, not on per-host scan telemetry

Typically seen on

legacy AppleTalk-capable routers, classic Mac OS / early Mac OS X hosts, and AppleTalk-era LaserWriter print servers — all pre-dating the 2009 Mac OS X 10.6 removal of client-side AppleTalk

Analyst note

A responsive port 206 today is unusual given AppleTalk's near-total obsolescence since 2009; treat it as a legacy-equipment signal, coincidental unrelated service, or scanning artifact rather than assume active AppleTalk traffic.

Port 206/udp is registered with IANA under the service name "at-zis," described as "AppleTalk Zone Information," with a blank Reference field and no assignee or contact listed in the registry — this port is dual-registered, with an identical entry for 206/tcp under the same name and description. The service belongs to AppleTalk's Zone Information Protocol (ZIP), a network-layer AppleTalk component that let routers and servers map AppleTalk network numbers to human-readable zone names so client software — classically the Mac OS "Chooser" — could browse available services grouped by zone rather than by raw network number. AppleTalk itself is a legacy Apple-designed networking suite from the 1980s and 1990s; Apple deprecated it and Mac OS X dropped native support around 2009, so genuine ZIP traffic today would almost always originate from a niche legacy AppleTalk segment rather than a mainstream deployment. The main software lineage still capable of speaking this protocol is Netatalk, an open-source AppleTalk/AFP file-and-print server for Unix-like systems whose atalkd daemon implements RTMP, NBP, ZIP, and AEP; Netatalk dropped AppleTalk support in version 3.0 (July 2012) and restored it in version 4.0 (September 2024), adding MacIP tunneling for LocalTalk-only Macs. SANS ISC's port tracker shows ongoing low-level scan/probe traffic against port 206 with an overall "green" (low) threat rating, which most likely reflects generic full-range port sweeps rather than AppleTalk-specific targeting, since AppleTalk services are rare in current deployments — that attribution is an inference rather than a directly stated fact. No CVEs specific to this port were identified.

IANA assignment

at-zis — "AppleTalk Zone Information"; Reference blank (no RFC cited); Assignee/Contact blank in registry; dual-registered 206/tcp + 206/udp under an identical name/description [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 499); cross-checked https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023)

Registration/modification dates

Unknown (blank in registry — not fabricated) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Assignment notes / service code / unauthorized-use-reported

Unknown (blank in registry) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Related ports

206/tcp (identical dual registration under at-zis); other legacy AppleTalk service ports (e.g., 201/tcp at-rtmp, 202/tcp at-nbp, 204/tcp at-echo) share an analogous historical role [Likely]

Primary use

AppleTalk Zone Information Protocol (ZIP) — maps AppleTalk network numbers to zone names for client browsing (e.g., classic Mac OS Chooser)

Common/legacy software

classic Mac OS AppleTalk stack; Netatalk's atalkd on Unix/Linux (AppleTalk dropped in Netatalk 3.0, July 2012; restored in 4.0, September 2024, with MacIP tunneling) [Likely] — https://en.wikipedia.org/wiki/Netatalk, https://netatalk.io/manual/en/AppleTalk

Scanning/exposure notes

SANS ISC logs ongoing low-volume scan/probe traffic on port 206 with an overall threat level of "green" (low); attribution to AppleTalk-specific interest vs. generic port sweeps is an inference, not stated by the source [Likely] — https://isc.sans.edu/data/port/206