323

Port 323/tcp carries rpki-rtr, the RPKI-to-Router protocol a router uses to pull validated Route Origin Authorization (ROA) data from an RPKI validating cache; it is an internal infrastructure protocol that should generally stay restricted to the trusted router-to-cache path rather than exposed to the public internet.

IANA's Service Name and Transport Protocol Port Number Registry lists 323/tcp as rpki-rtr, "Resource PKI to Router Protocol," assignee [IESG], contact [IETF_Chair], reference [RFC6810] (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=323). The Registration Date and Modification Date columns are blank in the source registry and are reported blank rather than guessed. The companion row, 323/udp, is Reserved with no service assigned.

The registry's cited reference, RFC 6810, is the original RPKI-to-Router Protocol spec; the protocol was later revised as RFC 8210, which remains the current version-1 definition and still names TCP port 323 as the mandatory baseline transport, with TCP-AO, SSH, or TLS (on the adjacent port 324, rpki-rtr-tls) offered as secured alternatives (https://www.rfc-editor.org/rfc/rfc8210). IANA's own registry entry has not been updated to cite RFC 8210, so this file keeps RFC6810 as-listed rather than overwriting it.

In practice, 323/tcp connects a router doing BGP Route Origin Validation to an RPKI validating-cache implementation such as NLnet Labs Routinator, RIPE NCC RPKI Validator 3, or rpki.net's rcynic/RTR daemon (https://routinator.docs.nlnetlabs.nl/en/stable/rtr-service.html). No dated third-party scan telemetry (Shodan/Censys-style exposure count) for 323/tcp was located in this research pass, so prevalence is reported as Unknown rather than estimated.

Baseline transport

RFC 8210 mandates unauthenticated plain TCP as the required baseline mode for rpki-rtr on port 323, with TCP-AO, SSH, or TLS (port 324) as optional secured alternatives (https://www.rfc-editor.org/rfc/rfc8210).

Exposure

Because the mandatory baseline is unauthenticated, best practice is to keep 323/tcp reachable only from the internal router-to-cache path (VPN/allowlist/segment), not the open internet; no single dated source states this norm explicitly, so it is tagged [Likely].

Scanning data

Unknown — no located measurement of how many hosts expose 323/tcp to the internet; not fabricated.

Malware associations

none documented in this pass.

IANA assignment

rpki-rtr — "Resource PKI to Router Protocol"; reference [RFC6810]; assignee [IESG]; contact [IETF_Chair]; Registration/Modification Date blank in the source registry [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=323

Range class

well-known (0–1023) [Confirmed]

Prevalence

Unknown — no nmap-services or scan-telemetry figure located this pass [Unknown]

Related ports

324/tcp rpki-rtr-tls — TLS-secured variant of the same protocol [Confirmed] — https://www.rfc-editor.org/rfc/rfc8210

Primary use

RPKI-to-Router Protocol — router pulls validated ROA data from an RPKI validating cache for BGP Route Origin Validation

Other/unofficial uses

none documented; single-purpose protocol [Likely]

Security implications

RFC 8210 mandates unauthenticated plain TCP as the baseline transport, with TCP-AO/SSH/TLS(324) as secured alternatives; operational best practice restricts 323 to the internal router/cache path [Confirmed protocol requirement; Likely operational norm] — https://www.rfc-editor.org/rfc/rfc8210

Typically seen on

routers performing BGP Route Origin Validation, talking to RPKI validating caches (Routinator, RPKI Validator 3, rpki.net)

Analyst note

323/udp is Reserved with no assigned service in the same registry row-pair [Confirmed].

Port 323/udp carries no defined protocol and has no legitimate reason to be open on any network, internal or public: the IANA registry lists the UDP/323 row simply as "Reserved," with an empty service-name field and no RFC reference, unlike its TCP sibling.

Port 323/tcp, by contrast, is registered as rpki-rtr ("Resource PKI to Router Protocol") with reference RFC 6810, later updated by RFC 8210. That protocol delivers cryptographically validated RPKI prefix-origin data from an RPKI cache/validator to routers, so they can perform BGP route origin validation.

RFC 8210 specifies rpki-rtr as a TCP-only protocol on port 323, with TCP-AO (RFC 5925) as the intended eventual secure-transport upgrade over the unprotected base transport. No UDP transport mode for rpki-rtr was found in the RFC text, and no software was identified that listens on UDP/323 — implementations such as NLnet Labs Routinator and RIPE NCC RPKI Validator, along with router-vendor RTR clients, all operate over the TCP port.

Because the UDP row exists only as a registry placeholder rather than an active service, there is no sourced scanning or exposure telemetry specific to it, and no CVE record tied to UDP/323 was located.

Exposure

UDP/323 has no defined listener in mainstream software; any observed traffic on it is unexpected and worth investigating rather than assumed benign.

IANA service name (UDP row)

blank — registry marks the row "Reserved" with no service name assigned [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=323

IANA reference (UDP row)

blank [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, line 658

Common software (tied to the TCP/323 rpki-rtr use case)

NLnet Labs Routinator, RIPE NCC RPKI Validator, router-vendor RTR clients

Exposure/scanning data for UDP/323 specifically

Unknown — no dated scan census, Shodan/Censys stats, or CVE found [Unknown]

Port

323/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, line 658

323/tcp counterpart

rpki-rtr, "Resource PKI to Router Protocol," Reference RFC6810 [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, line 657

Primary protocol (rpki-rtr, applies to TCP only)

delivers RPKI-validated prefix-origin data to routers for BGP route origin validation; RFC 8210 specifies TCP transport, TCP-AO (RFC 5925) as the intended secure-transport upgrade [Confirmed] — https://www.rfc-editor.org/rfc/rfc8210

UDP transport mode for rpki-rtr

not found in the located RFC text; UDP/323 appears to be a reservation alongside the TCP assignment rather than an active protocol mode [Likely] — https://www.rfc-editor.org/rfc/rfc8210