270

Port 270/tcp carries no IANA-assigned service name. In the canonical IANA Service Name and Transport Protocol Port Number Registry, the 270/tcp row's Description field reads simply "Reserved," and every other column — service name, assignee, contact, registration date, modification date, and IANA reference — is blank. This is a distinct state from an actively-assigned port: it means the number is set aside and not available for informal use, but no organization has registered a protocol against it and no RFC documents a TCP service on it. The picture changes on the UDP side of the same number: 270/udp is officially assigned to the service name gist, described as "Q-mode encapsulation for GIST messages," with RFC 5971 as its reference. RFC 5971 (October 2010, Experimental status) defines the General Internet Signalling Transport (GIST) protocol, the message-transport layer of the IETF's Next Steps in Signaling (NSIS) framework, and its Q-mode datagram encapsulation runs over UDP port 270 specifically — no TCP counterpart was ever registered. NSIS/GIST saw limited academic and research-stack implementation in the mid-to-late 2000s and did not reach production deployment, so encountering an active listener on 270/udp is itself unusual. Because 270/tcp has no legitimate registered role, an analyst who observes a live TCP service on this port should treat it as non-standard by definition and investigate rather than map it to any known application; it is not documented in the standard "bad ports" or trojan-port reference lists checked (Kessler, Trend Micro, mthcht), so there is no established malware or backdoor association to cite — only the fact that any response here falls outside the registered use.

IANA assignment (TCP)

Description = "Reserved"; service name, assignee, reference, and dates all blank in the registry — no protocol formally assigned to 270/tcp [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

IANA reference (TCP)

blank column; no RFC governs 270/tcp itself, so none is cited here [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023) [Confirmed]

Protocol behind the UDP companion

RFC 5971 (Oct 2010, Experimental) defines GIST, the message-transport layer of the NSIS (Next Steps in Signaling) framework; Q-mode encapsulation is its UDP datagram mode

Malware/exposure notes

not listed in the "bad ports"/trojan-port references checked, so no known malicious association to cite; because the port is Reserved rather than assigned, any live TCP listener is anomalous by definition and warrants investigation [Likely] — https://www.garykessler.net/library/bad_ports.html, https://docs.trendmicro.com/all/ent/officescan/v10.5/en-us/osce_10.5_olhcl/osce_topics/what_are_trojan_ports_.htm, https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_ports_list.csv

Common software

none identified specifically for TCP/270 [Unknown]

Dual-registration note

270/udp IS separately assigned — service name gist, "Q-mode encapsulation for GIST messages," Reference RFC 5971 — this is a UDP-only assignment and does not extend to 270/tcp [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt, https://www.rfc-editor.org/rfc/rfc5971.html

Deployment history

NSIS/GIST implementations were limited to academic/research reference stacks (roughly 2005–2010) and did not reach production or commercial use; no TCP equivalent was ever registered [Likely] — https://www.rfc-editor.org/rfc/rfc5971.html

Related port correction

an initial web-search pass mis-attributed PT-TLS (RFC 6876) to 270/tcp; direct verification against the primary IANA registry text confirmed PT-TLS is actually 271/tcp, and 270/tcp is Reserved [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Port 270/udp is registered with IANA under the service name gist, described as "Q-mode encapsulation for GIST messages," with reference RFC 5971 (October 2009). GIST — General Internet Signalling Transport — is the base transport protocol of the IETF NSIS (Next Steps in Signaling) protocol suite, an experimental successor effort to RSVP-style signaling for tasks such as QoS reservation and firewall/NAT traversal control. RFC 5971 specifies that GIST's Query-mode (Q-mode) messages are always sent as UDP datagrams to this specific well-known port, allocated by IANA for exactly that purpose; Q-mode is used when a signaling node wants a message intercepted by an on-path peer router rather than delivered directly to a known next hop, so the datagram carries a distinguishing "magic number" as its first 32-bit word to reduce accidental collisions with unrelated UDP traffic, and may also carry an IP Router Alert Option. The counterpart TCP port, 270/tcp, is listed by IANA as Reserved with no assigned name — it is not a second live registration of the same service, just an adjacent, unused row in the registry. NSIS/GIST reached only Experimental RFC status, and the sources reviewed describe unresolved deployment obstacles (router fast-path limits on intercepting Query packets, NAT/firewall interference with signaling traffic), so no confirmed real-world software, vendor product, or scan-prevalence data for this port could be found in this pass; those aspects are recorded honestly as Unknown rather than guessed.

IANA assignment

gist — "Q-mode encapsulation for GIST messages"; Assignee/Contact/Registration Date/Modification Date/Service Code/Unauthorized Use Reported/Assignment Notes columns all blank in the registry [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Range class

well-known (0–1023) [Confirmed]

Prevalence / exposure-scanning

no Shodan/Censys-style scan-prevalence data found for 270/udp; SpeedGuide's port detail page returned HTTP 403 during this pass and could not be checked for malware/trojan associations [Unknown]

Related ports

270/tcp (Reserved, same port number, distinct unused row) [Confirmed]

Primary use

Q-mode encapsulation for GIST (General Internet Signalling Transport), the base transport of the IETF NSIS protocol suite; UDP datagrams to this well-known port carry a magic-number prefix and optionally an IP Router Alert Option

Other/unofficial uses

none confirmed in this research pass [Unknown]

Common software / real-world deployment

no specific vendor product or widely-deployed implementation confirmed; NSIS/GIST is Experimental-status IETF work with documented deployment obstacles (router fast-path limits on intercepting Query packets, NAT/firewall interference) and no confirmed current production use was found

Security implications

given the limited documented NSIS/GIST deployment, unsolicited 270/udp traffic on the public internet is plausibly scanner noise or unrelated/malformed traffic rather than genuine GIST signaling — this is a reasoned inference from the deployment-status sources above, not itself a sourced claim, and is labeled as such [Unknown/reasoned]

270/tcp cross-reference

Reserved, no assigned service name/reference — not a genuine dual assignment of the same service, just an adjacent unused registry row [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry row 603

Analyst note

legitimate GIST/NSIS traffic on 270/udp is expected to be rare given limited real-world adoption, but this is a genuinely registered IANA/RFC protocol assignment (not an obviously unused or fabricated port) — treat a responsive 270/udp as worth investigating rather than assuming malicious without further evidence.