261

Port 261/tcp is registered with IANA under the service name nsiiops, described as "IIOP Name Service over TLS/SSL" (the IANA Service Name and Transport Protocol Port Number Registry, cached IANA Service Name and Transport Protocol Port Number Registry, lines 585-586; cross-checked against the live IANA registry page and a secondary port-lookup aggregator, t1shopper.com). The assignment is dual-registered, with an identical row for 261/udp, and both the Assignee and Contact fields list [Jeff_Stewart]. The Registration Date, Modification Date, and Reference (RFC) columns are all blank in the registry, so no fabricated IANA reference or date has been attached to this entry — both angles independently confirmed the blank fields rather than guessing. Functionally, nsiiops is the TLS/SSL-secured counterpart to CORBA's IIOP (Internet Inter-ORB Protocol) naming service: CORBA Object Request Brokers (ORBs) use a naming service so distributed objects can resolve human-readable names to object references, and the port-261 variant wraps that exchange in TLS/SSL rather than sending it in the clear. This places the port squarely in the enterprise Java/CORBA middleware space — historically associated with J2EE application servers and CORBA ORB implementations that embedded a secure naming service — though no single canonical vendor list could be confirmed from a primary source in this pass, so that association is reported as likely rather than confirmed. No port-261-specific exposure statistics (Shodan/Censys counts) or CVE history were located in this pass; CORBA naming-service ports are generally middleware-internal and rarely intended for public exposure, but that observation is offered as general context rather than a port-261-specific finding, and is tagged Unknown accordingly.

IANA assignment

nsiiops — "IIOP Name Service over TLS/SSL"; reference blank; assignee/contact [Jeff_Stewart]; dual-registered 261/tcp + 261/udp, identical rows [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (cached IANA registry, lines 585-586); cross-checked https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

Range class

well-known (0–1023) [Confirmed]

Registration Date / Modification Date

blank in the cached IANA registry; not independently verified from a primary source (live registry XML too large to confirm a per-row date in this pass) — left null rather than guessed [Unknown] — the IANA Service Name and Transport Protocol Port Number Registry; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

IANA Reference (RFC)

none listed in the registry; left blank per no-fabrication policy [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

Related ports

no specific related-port list confirmed from a primary source in this pass [Unknown]

Primary use

CORBA IIOP Naming Service secured with TLS/SSL — lets CORBA ORBs resolve object names to object references over an encrypted channel; TLS/SSL-secured counterpart to plain CORBA IIOP naming conventions [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml, http://www.t1shopper.com/tools/port-number/corba-iiop-ssl/

Common software

enterprise Java/CORBA middleware and application servers historically exposing a secure IIOP naming service (e.g., IBM WebSphere, BEA WebLogic, CORBA ORB implementations such as VisiBroker/ORBIX) — single web-angle source, not independently corroborated

Exposure / scanning / CVE history

no port-261-specific Shodan/Censys prevalence data or CVE record found in this pass; CORBA/IIOP naming-service ports are generally middleware-internal and rarely intended for public exposure, but no port-261-specific incident is confirmed [Unknown]

Analyst note

treat as CORBA/J2EE middleware infrastructure rather than a general-purpose service; an open 261/tcp is more likely internal enterprise middleware than an internet-facing consumer service, though this is contextual reasoning rather than a sourced prevalence claim.

Port 261/udp is registered with IANA as nsiiops, described as "IIOP Name Service over TLS/SSL," with assignee Jeff Stewart and a blank Reference field; the identical service name, description, and assignee appear on the paired 261/tcp row, so the two form a single dual-protocol registration rather than two independent assignments. The underlying protocol is CORBA's (Common Object Request Broker Architecture) Interoperable Naming Service (INS), the mechanism ORB clients use to resolve object references by name; nsiiops denotes the variant of that naming lookup carried over TLS/SSL rather than plain IIOP. Because IIOP is a connection-oriented ORB protocol, virtually all real deployments — including its SSL-secured variant — run over TCP; the UDP side of this registration exists in the registry but has negligible standalone deployment. CORBA/IIOP middleware itself is largely a legacy enterprise technology, historically associated with ORB implementations such as omniORB and Java IDL stacks bundled into older application servers. No dated exposure statistics, honeypot data, or CVE specific to port 261 (TCP or UDP) surfaced in this research pass, so its real-world security posture is recorded as Unknown rather than invented; an analyst encountering an open 261/udp should treat it primarily as a signal of legacy CORBA/ORB infrastructure rather than a commonly abused service.

IANA assignment

nsiiops — "IIOP Name Service over TLS/SSL"; reference blank (no RFC cited in registry); assignee Jeff Stewart; dual-registered 261/tcp + 261/udp (identical name/description/assignee on both rows) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry, https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Range class

well-known (0–1023)

Registration/modification dates

blank in the source IANA registry for this entry; not fabricated [Confirmed — absence confirmed] — IANA registry

Prevalence

nmap-services observed open-frequency 261/udp ≈ 0.000659 — very low (roughly 7 in 10,000 scanned hosts in the nmap-services sample); the paired 261/tcp row is far rarer at ≈ 0.000025. That the UDP side scores higher despite IIOP being a connection-oriented TCP protocol is best read as generic mass-UDP-sweep background rather than real nsiiops deployment [Confirmed for the figures; Likely for the reading] — nmap-services dataset

Related ports

261/tcp (identical nsiiops registration, the primary carrier of this service) [Confirmed]

Primary use

CORBA Interoperable Naming Service (INS) lookup secured over TLS/SSL — the encrypted counterpart to plain IIOP name-server traffic

Protocol/transport note

IIOP (including its SSL variant) is connection-oriented and in practice carried almost exclusively over TCP; the UDP registration shares the same registry entry but sees negligible standalone deployment [Likely] — https://www.omniorb-support.com/omni43/omniORB/omniORB008.html, http://www.t1shopper.com/tools/port-number/corba-iiop-ssl/

Common software

CORBA ORB implementations supporting SSL-secured INS (e.g., omniORB; historically bundled Java IDL/ORB stacks in enterprise app servers); no single dominant modern product exposes this by default

Security implications / exposure data

Unknown — no CVE, honeypot report, or dated scanning statistic specific to port 261 (TCP or UDP) was found; general industry guidance treats unauthenticated legacy CORBA naming services as a historical attack surface, but no source ties that specifically to this port

Typically seen on

legacy enterprise CORBA/ORB middleware hosts; standalone UDP usage is rare given IIOP's TCP-oriented design [Likely]