300

Port 300/tcp carries tacacss, the IANA-registered TLS Secure Login Host Protocol for TACACS+, standardized in RFC 9887 (IETF, 2025). It carries TACACS+ authentication, authorization, and accounting (AAA) traffic wrapped in a TLS 1.3 handshake. Because TACACS+ governs administrative login and command authorization for routers, switches, and firewalls, this port belongs on trusted management networks, not the open internet.

IANA's registry lists the assignment date as 2025-07-15, with assignee IESG and contact IETF_Chair; RFC 9887 itself published later in 2025. The port is new enough that it has no meaningful internet-exposure telemetry yet, so any prevalence claim beyond "newly registered" would be invented rather than sourced.

TLS-secured TACACS+ on port 300 is a separate assignment from classic, unencrypted TACACS+ on well-known port 49 (TCP/UDP). RFC 9887 puts the encrypted variant on its own port rather than layering a STARTTLS-style upgrade onto port 49, specifically so operators can allow or block plaintext versus TLS-secured TACACS+ by port number and avoid downgrade attacks against an in-band upgrade.

Before this 2025 assignment, port 300/tcp had no official IANA registration. Community references (e.g., Wikipedia's port list) note informal, pre-2025 use by ThinLinc Web Access and the Spartan protocol; this legacy is secondary-sourced and unrelated to the current TACACSS registration, so traffic on port 300 should be confirmed by protocol inspection rather than assumed from the port number alone. 300/udp remains IANA-Reserved with no service name assigned.

IANA assignment

tacacss — "TLS Secure Login Host Protocol (TACACSS)"; reference RFC 9887; assignee [IESG], contact [IETF_Chair]; registration date 2025-07-15 [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

no dated scan/telemetry data found for this newly assigned port [Unknown]

Related ports

49/tcp and 49/udp (classic unencrypted TACACS+) [Confirmed] — general TACACS+ protocol knowledge

Primary use

TACACS+ (Terminal Access Controller Access-Control System Plus) AAA sessions secured with TLS 1.3, per RFC 9887

Other/unofficial uses

pre-2025, informally referenced by community port lists as ThinLinc Web Access and the Spartan protocol; unrelated to and predating the 2025 IANA TACACSS assignment

Security implications

administrative AAA traffic (even TLS-wrapped) should be restricted to trusted management networks; distinct from classic unencrypted TACACS+ on port 49; protocol should be confirmed by inspection due to unrelated legacy port-300 uses

Typically seen on

network-device AAA client/server implementations (TACACS+ daemons, network-OS AAA clients) once vendor support for RFC 9887 rolls out

Analyst note

300/udp is separately registered as IANA-Reserved with no service name; a working TLS-secured TACACS+ listener should only ever be found on internal/management-network hosts [Confirmed] — IANA registry

Port 300/udp carries no assigned service — IANA marks it "Reserved" with no service name, no assignee, and no reference — so any UDP traffic seen on this port should be treated as unexpected rather than as a known protocol, and it has no legitimate reason to be exposed to the public internet.

TCP port 300 is a different story: it was recently assigned the service name tacacss ("TLS Secure Login Host Protocol"), with assignee IESG, reference RFC 9887, and a registration date of 2025-07-15. That assignment is TCP-only and does not extend to the UDP side of port 300 — the two should not be conflated.

Two informal "port 300" associations turned up during research — ThinLinc Web Access (tlwebaccess, from Cendio) and the hobbyist Spartan protocol — but both explicitly run over TCP per their own documentation, not UDP. No dated, sourced evidence of any real-world software using UDP port 300 was found.

SANS Internet Storm Center tracks scan activity for "Port 300 (tcp/udp)" as a combined figure showing routine background internet-scan noise, typical of any low-usage port being swept by mass scanners. That dataset does not separate TCP from UDP, so it cannot support a UDP-specific exposure claim on its own.

IANA assignment

(blank — no service name assigned; description "Reserved") [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry; live-verified https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Range class

well-known (0–1023)

Prevalence

Unknown — no protocol-separated scan/telemetry data located for this pass [Unknown]

Related ports

300/tcp (tacacss, RFC 9887, distinct assignment — not shared with this UDP entry)

Primary use

Unknown — no confirmed real-world UDP application; ThinLinc Web Access and the Spartan protocol both default to this port but are documented as TCP-only, so neither applies [Confirmed negative] — https://www.cendio.com/resources/docs/tag/tlwebaccess_server.html; https://gemini.yesterweb.org/proxy/spartan.mozz.us/specification.gmi

Security implications

no legitimate expected traffic profile; treat inbound/outbound UDP/300 as anomalous/probe activity; do not confuse with TCP/300 (tacacss)

Typically seen on

no known legitimate hosts; background internet-scan noise (protocol-combined with TCP) per SANS ISC

Port / transport

300/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

TCP/300 contrast (not this entry)

tacacss — "TLS Secure Login Host Protocol (TACACSS)", assignee IESG, reference RFC 9887, registered 2025-07-15 [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv