24
Summary
- // if you see it open
- Listed in 'trojan-per-port' tables, most often tied to Back Orifice 2000 (BO2K). The association is weak: BO2K's listener is operator-configurable (any port 1-65535), F-Secure specifies no fixed default, and the documented BO2K defaults are 54320/tcp and 54321/udp — so a port-24 listing is a database-listing artifact rather than a BO2K default. Legitimate 'private mail' use is largely obsolete (modern systems use 25/587/465); any open 24/tcp on a public host is anomalous and warrants investigation.
- // analyst note
- 24/tcp has no IANA service name and almost no legitimate modern use. Don't read "Back Orifice" off the port number — BO2K can sit on any port and defaults to 54320/54321, not 24. Identify the listening process before drawing conclusions.
About port 24/tcp.
Port 24/tcp is one of the curiosities of the well-known range: it is registered with IANA but carries no service name. The canonical IANA Service Name and Transport Protocol Port Number Registry leaves the service-name field blank for both 24/tcp and 24/udp, lists the description "any private mail system," names the assignee and contact as Rick Adams (the UUNET founder responsible for many early assignments), and cites no RFC in the Reference column — the registry has no published registration date for the row either. The intent was never a single specified protocol: 24 was set aside as a catch-all so that proprietary or closed-network mail systems could run a relay without colliding with the standardized SMTP that lives next door on port 25. Some third-party port databases (whatportis, EventTracker, SpeedGuide) display the label priv-mail for this port, but that name is a community convention rather than the IANA assignment, which is genuinely empty. In practice port 24 sees essentially no legitimate internet-facing traffic today — organizations that need mail use SMTP (25), Submission (587), or SMTPS (465) — so an open 24/tcp on a public host is anomalous and worth a look. The port also appears in the "trojan-per-port" tables that several security sites publish, most often linked to Back Orifice 2000 (BO2K); that association is weak and should be read carefully. BO2K is a fully configurable remote-administration trojan whose listener can be set to any port from 1 to 65535 — F-Secure's description specifies no fixed default, and the widely documented BO2K defaults are 54320/tcp and 54321/udp, not 24 — so a port-24 listing is a database artifact rather than evidence that 24 is a BO2K default. For an analyst, treat an open 24/tcp as a rarely-legitimate port: identify the listening process, and weigh a configurable-port trojan or a misconfigured private relay rather than assuming any specific protocol from the port number alone.
- IANA assignment
- service name blank (no name assigned) — description "any private mail system"; assignee/contact Rick Adams; reference blank (no RFC cited); no registration date published; dual-registered 24/tcp + 24/udp with identical fields[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry
- Range class
- well-known (0–1023)
- Prevalence
- no meaningful legitimate internet-facing traffic today; not a high-frequency open port [Likely] — vendor/port-database commentary (no first-party scan figure located)
- Related ports
- 25 (SMTP), 587 (submission/STARTTLS), 465 (submissions/implicit TLS); contrast 31337/12345 (configurable-port trojans)
Primary use
catch-all for proprietary / closed-network private mail systems; not a single specified protocol; distinct from standardized SMTP on port 25
Other/unofficial uses
third-party databases label this port priv-mail, a community convention not present in the IANA registry (the IANA service-name field is empty)
Security implications
appears in "trojan-per-port" tables, most often tied to Back Orifice 2000 (BO2K). The association is weak: BO2K's listener is operator-configurable (any port 1–65535), F-Secure lists no fixed default, and the documented BO2K defaults are 54320/tcp + 54321/udp — so a port-24 listing is a database-listing artifact, not a BO2K default. Any open 24/tcp on a public host is anomalous and warrants investigation
Typically seen on
legacy or proprietary private-mail relays; otherwise an anomaly / possible configurable-port backdoor or decoy
- Analyst note
- 24/tcp has no IANA service name and almost no legitimate modern use. Don't read "Back Orifice" off the port number — BO2K can sit on any port and defaults to 54320/54321, not 24. Identify the listening process before drawing conclusions.
About port 24/udp.
Port 24/udp is registered with IANA with an empty service-name field, the description "any private mail system," and assignee/contact [Rick_Adams]; its reference, registration-date, and modification-date columns are all blank (dual-registered on TCP and UDP). This is not missing data — the first-party IANA Service Name and Transport Protocol Port Number Registry carries those cells empty, and 24/tcp on the adjacent row is registered identically. The "any private mail system" label is an early ARPANET-era catch-all: rather than name a specific wire protocol, it reserves the number for whatever private or proprietary mail system an operator chose to run, much like the way port 23 (Telnet) and the small-services cluster were carved out in the same period under similarly terse one-line descriptions. No RFC has ever defined a standardized protocol under this assignment, no service name was ever recorded (some third-party port databases display "priv-mail," but that label does not appear in the authoritative IANA row and should be treated as a database convenience, not a registry fact), and no mainstream mail server or client has been positively identified as using UDP/24. In practice the assignment is dormant: modern mail moves over SMTP (25, 465, 587), submission, and the IMAP/POP family, none of which touch port 24, so an open UDP/24 is far more likely legacy cruft, a misconfiguration, or a decoy than a live private-mail service. Security relevance is low and largely informal: there are no current CVEs specific to UDP/24, it is not a recognized amplification vector, and it does not surface among commonly observed open ports in mass-scan data. Some older community port lists flag port 24 against past Trojan or Back Orifice 2000 activity, but BO2K's documented default control channel is UDP 54321, so the port-24 association is unconfirmed and at best a user-configurable secondary channel rather than a canonical malware port. For an analyst, an open UDP/24 is best read as an obsolescence/reconnaissance signal — investigate the host's age and configuration, and disable the listener unless a specific legacy application is known to require it.
- IANA assignment
- service name (blank — no name recorded in IANA registry); description "any private mail system"; reference (blank — no RFC cited); assignee/contact [Rick_Adams]; dual-registered 24/tcp + 24/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 55–56)
- Range class
- well-known (0–1023) [Confirmed]
- Service-name discrepancy
- authoritative IANA row shows an empty service name; some third-party databases display "priv-mail," which is not a registry value [Likely] — IANA CSV (blank) vs. https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=24
- Registration / modification date
- blank in the IANA registry (authoritative blank, not missing) — Unknown [Confirmed] — IANA registry
- Prevalence
- nmap-services observed open-frequency 24/udp ≈ 0.000329 — very low (roughly 3 in 10,000 scanned hosts in the nmap-services sample); the paired 24/tcp row is higher at ≈ 0.001154 [Confirmed] — nmap-services dataset. The port still does not surface among commonly observed open ports in mass-scan/Shodan data, and no dated Shodan/Censys exposure count was located [Unknown]
- Related ports
- the mail cluster (25 SMTP, 465 SMTPS, 587 submission, 110 POP3, 143 IMAP); the legacy small/private placeholders near 24 (23 Telnet)
Primary use
legacy IANA placeholder reserving the number for any private/proprietary mail system; no standardized protocol ever defined under this assignment [Confirmed] — IANA registry; corroborated by IANA web listing (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=24)
Other/unofficial uses
no named mail server or client positively identified on UDP/24; effectively none in modern deployments
Security implications
no current CVEs specific to UDP/24; not a recognized amplification vector; older community port lists flag port 24 against past Trojan / Back Orifice 2000 activity, but BO2K's documented default channel is UDP 54321, so the association is unconfirmed [Likely/Threat-reported] — https://www.auditmypc.com/udp-port-24.asp, https://www.adminsub.net/tcp-udp-port-finder/24 (sources self-acknowledge accuracy limits)
Typically seen on
very old hosts / misconfigurations; an open UDP/24 is an anomaly or possible decoy
- Analyst note
- An open UDP/24 is statistically rare and an obsolescence/recon signal — treat as legacy cruft, possible decoy, or misconfiguration and disable unless a specific legacy application requires it; legitimate use is unlikely.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| priv-mail | TCP | any private mail system | 0.12% |
| priv-mail | UDP | any private mail system | 0.03% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.