210

Port 210/tcp is registered with IANA under two service names per transport: the well-formed primary z39-50 and the historic alias z39.50 (the period-containing string), both with the description "ANSI Z39.50," assignee Mark H. Needleman, and a blank reference field (dual-registered on TCP and UDP). IANA notes that it assigned the well-formed z39-50 as a replacement for z39.50, and that the z39.50 entry is now historic and not usable with many common service-discovery mechanisms — so the famous period form is the alias, not the canonical name. Z39.50 (technically identical to ISO 23950) is an international client/server application-layer protocol for searching and retrieving information from remote databases, and it is the backbone of library catalog (OPAC) search, interlibrary loan, and shared cataloging via MARC-record import. It is maintained by the Library of Congress Maintenance Agency, grew out of the 1980s Linked Systems Project, was approved as a NISO standard in 1988, and saw versions in 1988, 1992 (v2), 1995 (v3), and 2003, with ISO adopting it as ISO 23950 in 1998; its HTTP-based successors are SRU/SRW, and it is historically associated with WAIS. The IANA reference field is blank. Security-wise Z39.50 is still actively used in libraries; the protocol is plaintext with no built-in TLS, and historical server-implementation issues exist — for example the widely used Index Data YAZ toolkit's changelog records fixing a potential DoS in its COMSTACK/ODR layer and read-beyond-string bugs — so the exposure is primarily information-retrieval surface plus older-implementation parsing bugs rather than a single famous CVE. For an analyst, an open 210/tcp most likely indicates a live library catalog / Z39.50 server, usually legitimate; verify it is an intended public catalog service and that the implementation is patched.

IANA assignment

z39-50 (primary) / z39.50 (historic alias) — "ANSI Z39.50"; reference (blank — no RFC cited in IANA registry); assignee Mark H. Needleman; dual-registered 210/tcp + 210/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

appears in nmap-services; live in library systems (de-facto) [Well-established] — nmap-services file

Related ports

SRU/SRW (HTTP successors); OAI-PMH as alternative

Primary use

bibliographic/database search & retrieval (library OPACs, ILL)

Other/unofficial uses

WAIS lineage; basis of SRU/SRW successors [Well-established]

Security implications

plaintext, no built-in TLS; historical server-implementation bugs (e.g. YAZ COMSTACK/ODR DoS and read-beyond-string fixes); information-retrieval exposure

Typically seen on

library catalog servers (OPACs), ILS vendors, OCLC, LC

Analyst note

An open 210/tcp most likely indicates a live library catalog / Z39.50 server — usually legitimate; verify it's an intended public catalog and that the implementation is patched.

Port 210 is registered by IANA under the service name z39-50, with z39.50 listed as a historic alias, for both the tcp and udp transports with identical registry data. The description reads "ANSI Z39.50," and the registry's assignee/contact field names Mark H. Needleman rather than citing an RFC, so the Reference column is properly blank — RFC 1729, "Using the Z39.50 Information Retrieval Protocol," documents the protocol itself but is not the port's IANA-cited reference, and no assignment date is published in the registry. Z39.50 is a stateful, session-oriented, TCP-style client-server protocol for searching and retrieving bibliographic and other structured records across heterogeneous databases, historically maintained in the library and information-science community; a session begins with an INITIALIZE handshake before searches proceed. Despite the paired udp reservation on port 210, available research turned up no documented UDP-mode Z39.50 implementation or real traffic — the protocol's design assumes a persistent TCP session, so the udp registration looks like the standard tcp/udp pairing rather than evidence of an active UDP service. The best-documented real-world implementation is Index Data's YAZ toolkit (yaz-client, yaz-ztest, and the Zebra search engine), used inside many library integrated-library-system (ILS) products and Z39.50 gateways. No CVE or public security advisory specific to Z39.50 or port 210 was located, so exposure risk is described only in general terms rather than backed by a named incident.

IANA assignment

service name z39-50 (historic alias z39.50), description "ANSI Z39.50," assignee/contact [Mark_H_Needleman], dual-registered 210/tcp + 210/udp with identical data [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml)

IANA Reference / RFC

blank in the registry — the field names a person, not an RFC; RFC 1729 documents the Z39.50 protocol but is not IANA's cited reference for this port assignment, so the Reference column stays blank rather than being filled with RFC 1729

[Confirmed] — IANA registry; RFC 1729 (https://www.ietf.org/rfc/rfc1729.txt)

Assignment/registration date

Unknown — not published in the IANA registry (blank Registration Date column), consistent with many legacy pre-1990s port entries [Confirmed] — IANA registry (local cached copy + web registry agree)

Range class

well-known (0–1023) [Confirmed]

Prevalence (open-port scan frequency)

nmap-services observed open-frequency 210/udp ≈ 0.000511 (very low — roughly 5 in 10,000 scanned hosts in the nmap-services sample) [Confirmed] — nmap-services dataset; the dual-registered 210/tcp side is rarer at ≈ 0.000125, consistent with neither transport carrying meaningful live Z39.50 traffic

[Confirmed] — nmap-services dataset

Related ports

Unknown — no directly related port cluster was identified in this pass

Primary use

ANSI/NISO Z39.50, a stateful, connection-oriented client–server protocol for searching and retrieving bibliographic/catalog records across heterogeneous databases; a session opens with an INITIALIZE request/response

Common software

Index Data's YAZ toolkit (yaz-client, yaz-ztest, Zebra search engine), used inside numerous library ILS products and Z39.50 gateways; no vendor-specific UDP-mode software found [Confirmed] — Ubuntu manpages for yaz-client (https://manpages.ubuntu.com/manpages/xenial/man1/yaz-client.1.html) and yaz (https://manpages.ubuntu.com/manpages/bionic/man7/yaz.7.html)

Exposure/scanning notes

no port-210-specific Shodan facet count or dated exposure statistic was found in this pass; the one published figure available is the nmap-services open-frequency (≈ 0.000511 udp / ≈ 0.000125 tcp — see Prevalence) [Confirmed re: the nmap-services figure; Unknown re: a dated Shodan/Censys count] — nmap-services dataset; Shodan documentation (general scanning behavior only, not port-210-specific)

Security implications

no CVE or public advisory specific to Z39.50 or port 210 was located; general risk framing only — an internet-exposed, unauthenticated Z39.50 server could permit querying of the underlying database, but this is not backed by a named, dated incident

Malware associations

Unknown — no malware or backdoor association was found in this pass

TCP vs UDP reality

no source found documents an actual UDP-mode Z39.50 implementation or real UDP traffic on port 210; the protocol as specified is TCP-oriented and stateful, so the udp registry entry reads as the standard paired tcp/udp reservation rather than an active UDP service

[Likely] — Wikipedia; RFC 1729; IANA registry