211

Port 211/tcp is registered with IANA under the service name 914c-g, described as "Texas Instruments 914C/G Terminal." The registry carries a second, historic entry for the same port under the older spelling 914c/g, explicitly marked as an alias to 914c-g and flagged as no longer usable with common service-discovery mechanisms — a naming cleanup rather than a distinct service. Both entries are dual-registered on tcp and udp under the same assignee, Bill Harrell, with no registration date and no RFC or reference document listed in the registry; that blank Reference column reflects the source data and is not an omission. The 914C/G was a Texas Instruments terminal product from the era when serial/network terminal protocols were being folded into the emerging IANA port registry, and there is no evidence of actively maintained modern software implementing this service — it reads as a legacy, largely dormant assignment. From a security-monitoring standpoint, third-party application-signature databases classify traffic matching this port/protocol pairing as low-risk infrastructure noise rather than an attack vector, and no malware or trojan family is documented as using it. A live listener on 211/tcp today would be unusual and worth investigating as either a misconfigured legacy device, a decoy, or an unrelated service that happens to have bound the port, rather than treating it as inherently suspicious on its own.

IANA assignment

914c-g (historic alias 914c/g, marked non-usable for discovery) — "Texas Instruments 914C/G Terminal"; reference column blank; assignee Bill Harrell; dual-registered 211/tcp + 211/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)

Registration/modification date

Unknown — not populated in the IANA registry for this entry (left null, not invented) [Confirmed absence] — IANA CSV

IANA RFC/reference

Unknown — no RFC or reference document listed for this entry [Confirmed absence] — IANA CSV

Range class

well-known (0–1023)

Prevalence

nmap-services observed open-frequency 211/tcp ≈ 0.000427 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 211/udp side is comparable at ≈ 0.000329, so neither transport shows meaningful deployment [Confirmed] — nmap-services dataset

Related ports

Unknown — no adjacent-port relationship documented in sources reviewed [Unknown]

Primary use

legacy Texas Instruments 914C/G terminal protocol

Other/unofficial uses

Unknown — no evidence found of actively maintained modern software implementing this service [Unknown]

Security implications

Juniper Threat Labs application signature "914CG" classifies this traffic as Infrastructure/Miscellaneous, risk level 2 (low on their scale); no known virus/trojan association found in third-party port-risk databases [Likely] — Juniper Threat Labs (https://www.juniper.net/us/en/threatlabs/application-signatures/detail.914CG.html), AuditMyPC (https://www.auditmypc.com/tcp-port-211.asp)

Typically seen on

legacy/obsolete Texas Instruments terminal equipment; a live modern listener would be anomalous [Likely]

Analyst note

An open port 211 is not associated with known malware and is classified as low-risk infrastructure noise by threat-signature vendors, but the underlying service is an obsolete 1980s-era TI terminal protocol with no modern legitimate use — treat an active listener as worth confirming rather than alarming.

Port 211/udp is registered with IANA under the service name 914c-g, described as "Texas Instruments 914C/G Terminal." The registry entry notes that 914c-g is a well-formed replacement for an older, slash-form service name, 914c/g; that older name survives in the registry as a separate historic alias row pointing back at 914c-g, explicitly marked as "not usable for use with many common service discovery mechanisms." Both rows are attributed to assignee Bill Harrell, and both leave the Reference, Registration Date, Modification Date, and Assignment Notes columns blank for the primary entry — there is no RFC backing this assignment. The same 914c-g registration is dual-registered on 211/tcp with identical description and assignee, a pairing typical of IANA's early well-known-port allocations. The underlying service is a 1970s/80s-era Texas Instruments video terminal (the TI 914C/G, part of the 914 terminal family used with TI's Data Exchange System) rather than a modern network protocol, and no contemporary software or service was found that actively speaks it — this port is effectively a dormant, vestigial IANA assignment today. One third-party port-lookup aggregator (auditmypc.com) notes a historical Trojan/virus association with the port but frames it as non-current and gives no malware name, date, or corroborating source, so it is recorded here as a caveated, single-source signal rather than an established threat.

IANA assignment

914c-g — "Texas Instruments 914C/G Terminal"; reference blank (no RFC); assignee/contact [Bill_Harrell]; dual-registered 211/tcp + 211/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-522; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=211

Registration/modification dates

blank in the IANA source for both rows — recorded as null, not inferred [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-525

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 211/udp ≈ 0.000329 — very low (roughly 3 in 10,000 scanned hosts in the nmap-services sample); the paired 211/tcp row is slightly higher at ≈ 0.000427 [Confirmed] — nmap-services dataset

Related ports

211/tcp (identical dual registration) [Confirmed]

Primary use

legacy/historic — registered for the TI 914C/G video terminal (TI 914 terminal family, TI Data Exchange System); both TCP and UDP 211 carry the identical registration; no evidence found of any modern application actively using the port for its registered purpose [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=211, https://deskthority.net/viewtopic.php?t=11114, http://www.t1shopper.com/tools/port-number/211/

Common software using the port today

none identified in this research pass [Unknown]

Security implications

a third-party port-info aggregator (auditmypc.com) flags UDP 211 as historically associated with a Trojan/virus using the port for command-and-control-style traffic, but the source itself frames this as non-current and does not name the malware family or give a date; no CVEs or dated incident reports specific to 211/udp were found

Typically seen on

none expected on modern networks; legacy/vintage TI terminal-adjacent environments only, if any remain [Likely]

Malware associations

unnamed historical Trojan/virus reference per auditmypc.com; unverifiable beyond that single source [Likely]

Alias entry

a second registry row, service name 914c/g (slash form), same description/assignee, Assignment Notes state it is "an alias to \"914c-g\"" and "now historic, not usable for use with many common service discovery mechanisms"

[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-525