247

Port 247/tcp is registered with IANA under two related service names: the current canonical name subntbcst-tftp and a historic alias subntbcst_tftp, both carrying the description "SUBNTBCST_TFTP." Per the registry's own assignment notes, the underscore form is explicitly marked historic and superseded by the hyphenated form, which is now the well-formed name for service-discovery mechanisms. Both the primary and alias rows are dual-registered on TCP and UDP, and both leave the Reference (RFC), Registration Date, and Modification Date columns blank in the registry — no RFC or date is invented here, consistent with the source. The registered concept — "Sub Network Broadcast TFTP" — implies a subnet-broadcast variant of the Trivial File Transfer Protocol, but no primary vendor documentation, open-source project, or dated incident report was located confirming any specific software currently binds this port by default. The port does not appear in Wikipedia's well-known-ports table (which skips from 241 to 249), consistent with it being an obscure, rarely deployed assignment rather than one commonly seen in production networks or routinely targeted by scanners. If implemented as registered, any live instance would inherit plain TFTP's structural weaknesses (no authentication, cleartext transfer), but this is a reasoned inference from the protocol family, not a port-247-specific finding — no CVE or named incident ties directly to this port.

IANA assignment (primary)

subntbcst-tftp — "SUBNTBCST_TFTP"; assignee/contact [John_Fake]; Reference blank; dual-registered 247/tcp + 247/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV, lines 563-572; live registry search "247")

IANA assignment (historic alias)

subntbcst_tftp — same description, same assignee; registry's own Assignment Notes mark it "historic, not usable for use with many common service discovery mechanisms," alias of subntbcst-tftp [Confirmed] — same registry source

IANA Reference (RFC) field

blank for both tcp rows (primary and alias) — left blank, no RFC invented [Confirmed] — IANA registry CSV + live registry page

Registration/Modification dates

blank in the registry for all four rows (tcp/udp x primary/alias) — no dates fabricated [Confirmed] — IANA registry CSV

Range class

well-known (0–1023)

Prevalence/exposure

absent from Wikipedia's List of TCP and UDP port numbers well-known table (gap 241→249), consistent with obscure/rarely-scanned status; no dated primary-source scanning telemetry found characterizing internet-wide exposure for this port

[Likely/Unknown] — en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Related ports

primary TFTP service is 69/udp; port 247 is a distinct, obscure subnet-broadcast variant registered separately

Primary use

registered for a subnet-broadcast variant of TFTP ("Sub Network Broadcast TFTP"); in practice this is a legacy/rarely-implemented assignment with no confirmed current mainstream use

Other/unofficial uses

Unknown — no vendor, product, or open-source project confirmed to bind port 247 by default; low-authority directories loosely associate it with generic TFTP/PXE network-boot use, but these are unsourced secondary compilations, not primary documentation

Security implications

if implemented as registered, would inherit TFTP-family weaknesses (no authentication, cleartext transfer) permitting unauthorized file read/write on an exposed instance — a reasoned inference from the protocol family, not a port-247-specific finding; no dated CVE or incident located tying directly to this port; an unsourced secondary claim (auditmypc.com) that malware has "used" the port is unconfirmed and not backed by a dated report

Typically seen on

Unknown — no software confirmed to expose this port by default in current deployments

Analyst note

an open port 247 is unusual and not linked to any confirmed mainstream software; treat a hit as noteworthy/anomalous rather than expected, pending further evidence.

Port 247/udp is registered with IANA under the service name subntbcst-tftp, described in the registry as "SUBNTBCST_TFTP." The entry is a modern, well-formed replacement for an older alias, subntbcst_tftp, which the registry now marks historic and notes is "not usable for use with many common service discovery mechanisms" — a wording IANA applies to legacy names that predate its current naming conventions rather than to any deprecation of the underlying assignment. The assignee field literally reads "John_Fake," a long-standing IANA placeholder label attached to many pre-2000s port registrations rather than a real registrant, and should not be read as a person's name. Functionally, the name points to a subnet-broadcast variant of TFTP (Trivial File Transfer Protocol): rather than a client addressing a specific server, it broadcasts its request across the local subnet so any TFTP server configured to answer broadcast traffic can respond — a pattern associated with 1990s-era diskless or network-boot workstation environments that needed to locate a boot server without prior configuration. No RFC is cited for this assignment, no registration or modification date is recorded, and and — beyond the nmap-services open-frequency figure recorded below — no authoritative source ties current software or a specific CVE to this exact port; the remaining gaps are recorded honestly below rather than filled in.

IANA assignment

subntbcst-tftp (alias of historic subntbcst_tftp); description "SUBNTBCST_TFTP"; assignee field reads "[John_Fake]" (known IANA legacy placeholder, not a real name); reference blank; dual-registered on 247/tcp and 247/udp

[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-572

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 247/udp ≈ 0.000412 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 247/tcp row carries a frequency of 0 — never observed open in that sample [Confirmed] — nmap-services dataset; non-authoritative port-checker sites separately describe the port as rarely seen, but that is marketing-style copy, not measured telemetry [Unknown]

Related ports

69/udp (standard TFTP) [Well-established]

Registration/modification dates

blank in the IANA registry for both the tcp and udp rows; left null rather than invented [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-572

Primary use

subnet-broadcast variant of TFTP — a client broadcasts a TFTP request to the local subnet rather than addressing a known server, historically used by diskless/network-boot workstations [Likely] — https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/6185623; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=247

Other/unofficial uses

none identified from an authoritative source in this pass [Unknown]

Security implications

no CVE or advisory found tying a specific vulnerability to port 247/subntbcst-tftp; general TFTP risk applies where exposed — the protocol is unauthenticated and plaintext, and subnet-broadcast TFTP is a documented amplification/spoofing pattern in older literature (an attacker can spoof a victim's source address in a broadcast request so multiple servers reply to the victim)

Typically seen on

legacy diskless/network-boot client-server environments (historic); an application-signature entry for SUBNTBCST-TFTP exists in at least one vendor's traffic-classification catalog, documenting classification rather than deployment prevalence

Malware associations

none identified in this pass [Unknown]