28

Port 28/tcp carries no official IANA assignment: the IANA Service Name and Transport Protocol Port Number Registry lists both 28/tcp and 28/udp as "Unassigned," with a blank service name, no assignee or contact, no registration or modification date, and a blank reference field. It sits in the well-known range (0–1023) between two assigned neighbors — 27 (nsw-fe, NSW User System FE) and 29 (msg-icp, MSG ICP) — both of which carry the historical assignee Robert Thomas, but 28 itself was simply never allocated. The reason an analyst encounters port 28 at all is one vendor convention rather than a registered protocol: Palo Alto Networks documents TCP port 28 as the encrypted HA1 control-link port between high-availability (HA) peer firewalls and Panorama management appliances. When HA encryption is enabled, the HA1 control link (which exchanges hellos, heartbeats, configuration sync, and state between peers) runs over SSH on TCP port 28; when encryption is not enabled, Panorama instead uses ports 28769 and 28260 for the same control traffic. Wikipedia's "List of TCP and UDP port numbers" mirrors this, marking port 28 TCP as "Unofficial" and attributing it to Palo Alto Networks Panorama HA sync, explicitly distinguishing it from its IANA-assigned neighbors. Because this is an internal, peer-to-peer firewall management channel, it is not meant to face the public internet — a publicly reachable port 28 on a PAN-OS device would represent a misconfiguration of the HA control plane rather than a normal service. No CVEs, malware families, or notable internet-wide scanning campaigns specifically targeting port 28/tcp surfaced in the public sources reviewed as of June 2026, and the HA1 link's SSH encryption limits plaintext exposure on the wire. For an analyst, a responsive port 28 most plausibly indicates a Palo Alto HA deployment; absent that context it is an unassigned port worth treating as an anomaly.

IANA assignment

Unassigned — no service name, no assignee, no contact, blank reference; both 28/tcp and 28/udp identically Unassigned [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, port 28 rows)

Range class

well-known (0–1023)

Registration / modification date

none (blank in IANA registry) [Confirmed] — IANA registry CSV

IANA reference (RFC)

blank — no RFC cited [Confirmed] — IANA registry CSV

Common software

Palo Alto Networks Panorama and PAN-OS NGFW firewalls; no other software with documented use of this port found

Security implications

internal peer-to-peer HA control channel, not intended to be internet-facing; public exposure would be a misconfiguration; HA1 SSH encryption limits plaintext risk; no CVEs, malware, or notable scanning campaigns specific to port 28/tcp found in public sources as of June 2026

Typically seen on

Palo Alto Networks PAN-OS firewalls / Panorama in an HA pair; otherwise an anomaly on an unassigned port

Primary (unofficial) use

Palo Alto Networks Panorama / PAN-OS HA1 encrypted control link between HA peers, SSH over TCP, when HA encryption is enabled (unencrypted control traffic uses 28769 + 28260 instead) [Confirmed] — Palo Alto "Ports Used for HA" docs

Neighboring ports

27 nsw-fe (NSW User System FE) and 29 msg-icp (MSG ICP), both assignee Robert Thomas [Confirmed] — IANA registry CSV

Wikipedia designation

"Unofficial" — Palo Alto Networks Panorama HA sync encrypted port [Confirmed] — Wikipedia "List of TCP and UDP port numbers"

Analyst note

a responsive port 28 most plausibly signals a Palo Alto HA deployment; absent that context, treat an unassigned-port listener as worth investigating.

Port 28/udp is listed in the IANA Service Name and Transport Protocol Port Number Registry as Unassigned: it carries no service name, no assignee, no description, and no RFC reference. The companion port 28/tcp is likewise Unassigned, so neither transport has an official well-known service. Because nothing is registered here, any UDP service answering on port 28 is non-standard, and its meaning is entirely whatever the local operator chose to put there — there is no IANA-blessed protocol to expect. The only real-world association port 28 carries in networking documentation is Palo Alto Networks' Panorama high-availability deployments, which use port 28 for the encrypted HA1 control-link between high-availability peer firewalls; however, that link is SSH-based and strictly TCP, not UDP, and Wikipedia's port list flags it as unofficial (not an IANA assignment). Palo Alto's own documentation confirms the protocol is TCP, so it does not apply to the 28/udp datagram port. For an analyst, the practical takeaways are: there is no documented software that uses 28/udp as a designated port; SANS Internet Storm Center shows only low, green-rated scanning interest in port 28 (TCP side), consistent with routine automated reconnaissance rather than targeted exploitation; and no CVEs or malware families specifically targeting 28/udp appear in available sources. A host responding on 28/udp should therefore be treated as a locally-defined, non-standard listener — investigate what the operator deployed rather than assuming a known service. The IANA reference field is blank, and it stays blank here because the registry cites no RFC.

IANA assignment

Unassigned — no service name, no assignee, no description, blank reference (no RFC cited in IANA registry); 28/tcp is also Unassigned [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

well-known (0–1023)

Prevalence

no IANA registration; not a recognized service port. SANS ISC records only minimal, green-rated scanning on port 28 (TCP side) [Likely] — SANS Internet Storm Center port 28

Related ports

28/tcp (also Unassigned); contrast with assigned low ports in the well-known range

Primary use

none — unassigned by IANA; no known active UDP protocol uses 28/udp as its designated well-known port

Other/unofficial uses

none confirmed for UDP. The Palo Alto Panorama HA1 control-link use of port 28 is TCP-only (SSH-based) and unofficial, so it does not apply to 28/udp

Security implications

because the port is unassigned, exposure depends entirely on whatever the operator deployed; any 28/udp listener is non-standard. No CVEs, documented vulnerabilities, or malware families specifically targeting 28/udp found in available sources; scanning activity on port 28 (TCP) is low and rated green

Typically seen on

nothing standard — a responsive 28/udp is a locally-defined, non-standard listener and an anomaly

Analyst note

28/udp is unassigned, so a response there is not a known service. Investigate what the operator placed on the port; do not assume the Palo Alto Panorama association (that is TCP-only and unofficial).