218
Summary
- // if you see it open
- Obsolete and obscure. Credentials traverse in cleartext; RFC 1204 itself advises running the server in a secured environment with restricted physical and network access.
- // analyst note
- An open 218 is almost certainly a misidentified service; genuine MPP deployment is essentially extinct.
About port 218/tcp.
Port 218/tcp is registered with IANA as mpp with the description "Netix Message Posting Protocol," assignee Shannon Yeh, and a blank reference field (dual-registered on TCP and UDP). MPP is defined in RFC 1204 (S. Yeh and D. Lee, Netix Communications, Inc., February 1991) as an Experimental protocol. Its purpose is to let a workstation or PC — which lacks operating-system-level user authentication — post mail to a message posting server that authenticates the sender with USER and PASS commands and then submits the message to the local mail transfer agent (Sendmail or MMDF), preventing mail forgery. The command and reply structure deliberately mirrors SMTP and FTP, with commands such as USER, PASS, DATA, NOOP, and QUIT and replies like "220 Message Posting Service Ready," and RFC 1204 specifies that port 218 is assigned for the Netix Message Posting Protocol. The IANA reference field is blank. The protocol is obscure and obsolete. Security-wise RFC 1204 itself advises running the server in a secured environment with well-restricted physical and network access, reflecting that credentials traverse it in cleartext. For an analyst, an open 218 is almost certainly a misidentified service, since genuine MPP deployment is essentially extinct; generic port databases that "flag" 218 carry boilerplate disclaimers rather than evidence of specific malware.
- IANA assignment
mpp— "Netix Message Posting Protocol"; reference (blank — no RFC cited in IANA registry); assignee Shannon Yeh; dual-registered 218/tcp + 218/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- rare/obscure (de-facto) [Well-established] — nmap-services file
- Related ports
- 25 (SMTP)
Primary use
authenticated mail posting from PCs/workstations to an MTA (RFC 1204); obsolete
Other/unofficial uses
none today [Well-established]
Security implications
obsolete; cleartext credentials; RFC 1204 advises running it in a secured, access-restricted environment [Well-established]
Typically seen on
effectively none; misidentified services
- Analyst note
- An open 218 is almost certainly a misidentified service; genuine MPP deployment is essentially extinct.
About port 218/udp.
Port 218/udp is registered with IANA under the service name mpp ("Netix Message Posting Protocol"), assignee Shannon Yeh, with a blank Reference field — the identical registration that appears for 218/tcp, differing only in the Transport Protocol column. The only specification for MPP is RFC 1204 (S. Yeh and D. Lee, Netix Communications, Inc., February 1991, Experimental status), which describes a TCP-only, SMTP/FTP-style command-and-reply protocol (USER, PASS, DATA, NOOP, QUIT) letting an unauthenticated PC or workstation post outgoing mail to a server that authenticates the sender and hands it to the local mail transfer agent. Nothing in RFC 1204 describes a UDP transport, mode, or datagram framing for MPP, so the 218/udp registry row reads as a companion or mirror of the tcp assignment rather than an independently specified protocol — a common pattern in the legacy IANA registry where paired tcp/udp rows were registered together without the service ever actually running on both. No software implementing MPP over UDP was found, and no malware family or scanning campaign specific to 218/udp is documented; generic port-checker sites carry boilerplate "may have been used by a Trojan" disclaimers rather than concrete findings. An analyst seeing unsolicited traffic on 218/udp should treat it as most likely random internet background-noise scanning or a misidentified/spoofed packet rather than a live MPP service, since genuine deployment of this protocol — even over its documented tcp transport — is essentially extinct.
- IANA assignment
mpp— "Netix Message Posting Protocol"; Reference field blank; assignee/contact[Shannon_Yeh]; identical row to 218/tcp aside from transport [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 539; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt- Range class
- well-known (0–1023) [Confirmed] — port-number range is definitional
- Registration/modification date, Service Code, Unauthorized Use Reported, Assignment Notes
- all blank in the IANA registry for this row — not fabricated, left null [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 539
- Prevalence
- nmap-services observed open-frequency 218/udp ≈ 0.000593 — very low (roughly 6 in 10,000 scanned hosts in the nmap-services sample); the paired 218/tcp row carries a frequency of 0 (never observed open in the same sample), which is notable given RFC 1204 specifies MPP over TCP only — the UDP figure therefore reads as generic mass-UDP-sweep background rather than live MPP [Confirmed for the figures; Likely for the reading] — nmap-services dataset
- Related ports
- 218/tcp (mpp, sibling registration, same service name); 25 (SMTP, the mail-submission analog MPP was designed to feed)
Protocol basis
RFC 1204 defines MPP for TCP only (Feb 1991, Experimental/Legacy, not Standards-Track); no UDP mechanism is described anywhere in the RFC, so the udp registration is best read as a mirror/companion of the tcp entry rather than an independently specified UDP protocol [Confirmed] — https://datatracker.ietf.org/doc/html/rfc1204; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
Other/unofficial uses
none found — no known software implements MPP over UDP
Security implications / exposure notes
no port-218-specific malware family, CVE, or documented scanning campaign found; generic port-checker sites carry site-wide boilerplate Trojan-disclaimer language rather than a specific finding for this port; given negligible real-world MPP deployment, unsolicited 218/udp traffic is more plausibly broad scanning noise or spoofed/misconfigured traffic than exploitation of a running service — not corroborated against dedicated scanning-telemetry (Shodan/Censys/GreyNoise) this pass
Typically seen on
effectively none; anomalous or misidentified traffic [Likely]
- Analyst note
- Treat an open/responsive 218/udp as very unlikely to be genuine MPP — the protocol has no defined UDP behavior — and investigate as scanning noise, a misconfigured mirror of a tcp assignment, or a misidentified service rather than a real running server.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| mpp | UDP | Netix Message Posting Protocol | 0.06% |
| mpp | TCP | Netix Message Posting Protocol | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.