224

Port 224/tcp is registered with IANA under the service name masqdialer, assigned to Charles Wright, with both the Registration Date and Reference columns blank in the registry — no RFC or memo backs this assignment, and no date is recorded, so both fields are left unfilled here rather than invented. The registry's own assignment note flags a possible conflict with port 222, which is also associated with "Masqdialer" naming, though 224 is the entry IANA actually lists under that service name. The same service name and assignee are duplicated on 224/udp with identical registry metadata, confirming a standard dual TCP/UDP registration rather than two unrelated assignments. Masqdialer traces to the Linux "IP Masquerade" dial-up era: a small daemon that let a server export its attached modems to remote clients over a raw TCP stream, described in the old Modem-Sharing Mini-HOWTO (which itself demonstrates the tool on a different, non-default port in its sample configuration). Real-world usage today is negligible — nmap's service-frequency data records the port as essentially never observed in scans — and no CVEs or exploitation reports are tied to it; live scan-dashboard data shows only generic background internet noise on 224, not targeted activity. Because the software and its use case are effectively obsolete, an unexpected open 224/tcp is more likely an unrelated custom service, a misconfiguration, or a decoy than a live masqdialer instance, and should be triaged with that low-prevalence context in mind rather than treated as an urgent finding on its own.

IANA assignment

masqdialer — description "masqdialer"; assignee [Charles_Wright]; contact [Charles_Wright]; Registration Date blank; Reference blank; dual-registered 224/tcp + 224/udp with identical fields [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (cached local copy, rows 550-551); cross-checked at https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=224

Assignment note

registry lists "Possible Conflict of Port 222 with 'Masqdialer'" — the registry itself flags ambiguity between ports 222 and 224 for this service name [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, row 550

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 224/tcp ≈ 0.000025, 224/udp ≈ 0.000000 — essentially never observed in real-world scans, consistent with obsolete dial-up-era software [Confirmed] — https://svn.nmap.org/nmap/nmap-services

Related ports

222/tcp (registry-noted naming conflict with "Masqdialer") [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, row 550

Primary use / common software

Masqdialer, a legacy Linux dial-up modem-sharing daemon from the IP-Masquerade era that exports server-attached modems to remote clients over a raw TCP/IP stream; the Modem Sharing Mini-HOWTO's example configuration itself uses a different port (5800), with 224 being simply the IANA-registered default for the service name

Exposure / scanning notes

SANS ISC's live port dashboard for port 224 (checked 2026-07-17) shows only low-volume, low-source-count background/opportunistic scan traffic, threat level green, with no CVEs or abuse reports tied to the port

Security implications

low risk in practice mainly because almost nothing runs a live masqdialer service today, not because the protocol was ever hardened; observed traffic reads as generic background scanning rather than targeted exploitation

Typically seen on

legacy Linux dial-up / IP-Masquerade hosts (rare); otherwise likely an unrelated custom service, misconfiguration, or decoy given the software's obsolescence [Likely]

Known CVEs

none found in this research pass [Unknown]

Port 224/udp is registered with IANA as masqdialer, with assignee and contact both listed as Charles_Wright and a blank Reference column — meaning no RFC backs this assignment. The registry carries an unusual Assignment Notes remark flagging a "Possible Conflict of Port 222 with Masqdialer," and the same registry entry is dual-registered on 224/tcp with identical description, assignee, contact, and note. masqdialer itself was a dial-up-era client/server utility, written by Charles Wright, that let authorized users on a Linux IP-Masquerade gateway start, stop, and check the status of the box's outbound modem connections remotely, without needing a shell or telnet account — clients existed for Linux, Windows, NetBSD, MacOS, and a Java/web front end. Notably, the software's own documentation (the masqdialer.conf man page) states the daemon actually defaults to listening on port 222, not 224, which appears to be the real-world source of the registry's own conflict note: the officially assigned port and the software's shipped default disagree. As dial-up modem-sharing is obsolete, legitimate traffic on 224/udp today would be essentially unheard of; any hit is far more likely to reflect scanner noise, a misconfigured NAT/firewall rule, or an unrelated ad hoc UDP responder than an actual masqdialer instance.

IANA assignment

masqdialer — description "masqdialer"; assignee/contact [Charles_Wright]; Reference column blank; dual-registered 224/tcp + 224/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (udp), :550 (tcp)

Range class

well-known (0–1023) [Confirmed]

Assignment notes

registry text reads "Possible Conflict of Port 222 with \"Masqdialer\"" [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Registration/modification dates

blank in the cached IANA registry for this row — left blank, not fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Prevalence

no nmap-services open-frequency figure available in the sources checked [Unknown]

Related ports

222/tcp and 222/udp (the registry's own noted conflict) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Primary use

masqdialer client/server system for remotely controlling a Linux IP-Masquerade gateway's dial-out modem (start/stop/status), with Linux, Windows, NetBSD, MacOS, and Java/web clients [Confirmed] — https://tldp.org/HOWTO/Linux-Modem-Sharing/the-server-side.html, https://archive.org/details/tucows_8907_masqdialer_Server

Security implications

no CVEs or named exploits found against this port/service; a generic port-lookup aggregator (auditmypc.com) lists a historical virus/trojan flag while simultaneously showing current status "Virus/Trojan: No" — self-contradictory and unverified, so the malware association is treated as Unknown rather than asserted

Typically seen on

legacy/obsolete dial-up-modem-sharing gateways; effectively unused on the modern internet

Software default vs. IANA assignment

the masqdialer.conf man page documents the daemon's actual default listening port as 222, not 224 — the likely real-world source of the registry's own "conflict with port 222" note [Confirmed] — https://man.cx/masqdialer.conf(5)

Scanning activity

SANS ISC rates port 224 overall threat level "green" (low), with only generic day-to-day background scan noise, no port-224-specific campaign identified; this is a live data source that changes daily, not a static fact [Likely] — https://isc.sans.edu/data/port/224