287
Summary
- // if you see it open
- No documented deployment pattern exists to assess public-internet exposure; treat any live listener as unverified. One secondary ports database (auditmypc.com) reports no known virus/trojan association, a single-source, low-confidence finding. IANA's Registration Date, Modification Date, and Reference fields are all blank, so no dated registration event or RFC backs this assignment.
- // analyst note
- Treat an unexpected open 287/tcp as worth investigating; the service is obscure enough that legitimate traffic is unlikely on most networks, but no confirmed baseline exists to compare against.
About port 287/tcp.
Port 287/tcp is IANA-registered under the service name k-block, but no publicly documented protocol, vendor product, or RFC describes what actually runs on it — so whether it belongs on the public internet cannot be determined from available sources, and Unknown is the honest classification rather than a guessed default.
The registry entry lists only the terse description "K-BLOCK," with Simon P Jackson as both assignee and contact, and 287/tcp plus 287/udp registered as an identical pair. IANA's Registration Date, Modification Date, and Reference columns are all blank in the CSV, meaning no dated registration event or backing RFC exists for this assignment — a confirmed absence in the source, not a research gap.
A commonly circulated claim links this port to "Kastle Systems" access-control hardware. That attribution was checked against available sources during this research pass and found unsupported, so it is explicitly excluded rather than repeated as fact. Separately, one secondary ports database reports no known virus or trojan association for port 287, though this is a single-source, low-confidence finding rather than a confirmed clean bill of health.
For an analyst, the practical takeaway is that k-block is obscure enough that legitimate traffic is unlikely on most networks. An unexpected listener on 287/tcp is worth investigating on its own merits rather than being dismissed or assumed to match any specific known application, since no confirmed baseline deployment exists to compare against.
- IANA assignment
k-block— description "K-BLOCK"; assignee/contact Simon P Jackson; Registration Date, Modification Date, and Reference fields all blank in registry; dual-registered 287/tcp + 287/udp[Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=k-block- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- Not researched in this pass — no scanning/telemetry data gathered [Unknown]
- Related ports
- 287/udp — the same
k-blockregistration, dual-registered by IANA with an identical description ("K-BLOCK") and the same assignee/contact [Simon_P_Jackson]; a service-name and assignee search of the cached registry returns these two rows and no others, so 287/udp is the only port related to this one by registration[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry k-block 287/udp
Primary use
Undocumented — the registry names the service k-block but no protocol specification, RFC, or vendor documentation describing its behavior was found
Other/unofficial uses
A circulating attribution to "Kastle Systems" access-control hardware was checked and found unsupported by any source; not reported as fact [Unknown]
Security implications
No documented deployment pattern to assess exposure against; one secondary database (auditmypc.com) reports no known malware/trojan association for this port (single-source)
Typically seen on
Unknown — no vendor or deployment context found [Unknown]
- Analyst note
- Treat an unexpected open 287/tcp as worth investigating; the service is obscure enough that legitimate traffic is unlikely on most networks, but no confirmed baseline exists to compare against.
About port 287/udp.
Port 287/udp carries the IANA-registered service k-block (description "K-BLOCK"), but no RFC, protocol specification, or identifiable real-world software was found describing what actually runs on it — so whether it belongs on the public internet or should stay internal-only is genuinely Unknown rather than answerable either way from available sources.
The IANA Service Name and Transport Protocol Port Number Registry lists 287/udp under assignee Simon P Jackson, a private registrant, with the Registration Date, Modification Date, and Reference (RFC) fields all blank in the source record. Port 287/tcp carries an identical dual registration — same name, same description, same assignee — but likewise ships with no accompanying specification.
Searches for common software, protocol write-ups, or notable-ports references turned up nothing: the port is absent from Wikipedia's curated well-known/registered ports table and from general discussion of common UDP ports, consistent with a registration that was never widely (or perhaps ever) implemented in deployed software.
One secondary aggregator (auditmypc.com) flags no virus or trojan association for this port, which is weak corroboration at best given it is not an authoritative source. No credible malware or backdoor reporting was found for 287/udp in this research pass.
- IANA assignment
k-block— "K-BLOCK"; reference (blank — no RFC cited in IANA registry); assignee Simon P Jackson; dual-registered 287/tcp + 287/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- Not established — no telemetry/nmap-services data surfaced in this pass; port absent from Wikipedia's curated notable-ports table [Unknown]
- Related ports
- 287/tcp — identical dual IANA registration, same service name and assignee [Confirmed] — IANA registry
Primary use
Unknown — no RFC, protocol specification, or identified deployed software found
Other/unofficial uses
None found in this research pass [Unknown]
Security implications
No credible malware/backdoor association found (single low-authority aggregator reports none); no known legitimate deployment identified, so an unexpected open port is anomalous and worth investigating
Typically seen on
Unknown — no evidence of real-world deployment found [Unknown]
- Analyst note
- An obscure, essentially undocumented IANA registration with no confirmed real-world usage on either transport; treat a responsive host on this port as worth investigating rather than assume it is either benign or malicious.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| k-block | TCP | — | 0.00% |
| k-block | UDP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.