323

Port 323/tcp carries rpki-rtr, the RPKI-to-Router protocol a router uses to pull validated Route Origin Authorization (ROA) data from an RPKI validating cache; it is an internal infrastructure protocol that should generally stay restricted to the trusted router-to-cache path rather than exposed to the public internet.

IANA's Service Name and Transport Protocol Port Number Registry lists 323/tcp as rpki-rtr, "Resource PKI to Router Protocol," assignee [IESG], contact [IETF_Chair], reference [RFC6810] (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=323). The Registration Date and Modification Date columns are blank in the source registry and are reported blank rather than guessed. The companion row, 323/udp, is Reserved with no service assigned.

The registry's cited reference, RFC 6810, is the original RPKI-to-Router Protocol spec; the protocol was later revised as RFC 8210, which remains the current version-1 definition and still names TCP port 323 as the mandatory baseline transport, with TCP-AO, SSH, or TLS (on the adjacent port 324, rpki-rtr-tls) offered as secured alternatives (https://www.rfc-editor.org/rfc/rfc8210). IANA's own registry entry has not been updated to cite RFC 8210, so this file keeps RFC6810 as-listed rather than overwriting it.

In practice, 323/tcp connects a router doing BGP Route Origin Validation to an RPKI validating-cache implementation such as NLnet Labs Routinator, RIPE NCC RPKI Validator 3, or rpki.net's rcynic/RTR daemon (https://routinator.docs.nlnetlabs.nl/en/stable/rtr-service.html). No dated third-party scan telemetry (Shodan/Censys-style exposure count) for 323/tcp was located in this research pass, so prevalence is reported as Unknown rather than estimated.

IANA assignment

rpki-rtr — "Resource PKI to Router Protocol"; reference [RFC6810]; assignee [IESG]; contact [IETF_Chair]; Registration/Modification Date blank in the source registry [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=323

Range class

well-known (0–1023) [Confirmed]

Prevalence

Unknown — no nmap-services or scan-telemetry figure located this pass [Unknown]

Related ports

324/tcp rpki-rtr-tls — TLS-secured variant of the same protocol [Confirmed] — https://www.rfc-editor.org/rfc/rfc8210

Primary use

RPKI-to-Router Protocol — router pulls validated ROA data from an RPKI validating cache for BGP Route Origin Validation

Other/unofficial uses

none documented; single-purpose protocol [Likely]

Security implications

RFC 8210 mandates unauthenticated plain TCP as the baseline transport, with TCP-AO/SSH/TLS(324) as secured alternatives; operational best practice restricts 323 to the internal router/cache path [Confirmed protocol requirement; Likely operational norm] — https://www.rfc-editor.org/rfc/rfc8210

Typically seen on

routers performing BGP Route Origin Validation, talking to RPKI validating caches (Routinator, RPKI Validator 3, rpki.net)

Analyst note

323/udp is Reserved with no assigned service in the same registry row-pair [Confirmed].

Port 323/udp carries no defined protocol and has no legitimate reason to be open on any network, internal or public: the IANA registry lists the UDP/323 row simply as "Reserved," with an empty service-name field and no RFC reference, unlike its TCP sibling.

Port 323/tcp, by contrast, is registered as rpki-rtr ("Resource PKI to Router Protocol") with reference RFC 6810, later updated by RFC 8210. That protocol delivers cryptographically validated RPKI prefix-origin data from an RPKI cache/validator to routers, so they can perform BGP route origin validation.

RFC 8210 specifies rpki-rtr as a TCP-only protocol on port 323, with TCP-AO (RFC 5925) as the intended eventual secure-transport upgrade over the unprotected base transport. No UDP transport mode for rpki-rtr was found in the RFC text, and no software was identified that listens on UDP/323 — implementations such as NLnet Labs Routinator and RIPE NCC RPKI Validator, along with router-vendor RTR clients, all operate over the TCP port.

Because the UDP row exists only as a registry placeholder rather than an active service, there is no sourced scanning or exposure telemetry specific to it, and no CVE record tied to UDP/323 was located.

IANA service name (UDP row)

blank — registry marks the row "Reserved" with no service name assigned [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=323

IANA reference (UDP row)

blank [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, line 658

Common software (tied to the TCP/323 rpki-rtr use case)

NLnet Labs Routinator, RIPE NCC RPKI Validator, router-vendor RTR clients

Exposure/scanning data for UDP/323 specifically

Unknown — no dated scan census, Shodan/Censys stats, or CVE found [Unknown]

Port

323/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, line 658

323/tcp counterpart

rpki-rtr, "Resource PKI to Router Protocol," Reference RFC6810 [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, line 657

Primary protocol (rpki-rtr, applies to TCP only)

delivers RPKI-validated prefix-origin data to routers for BGP route origin validation; RFC 8210 specifies TCP transport, TCP-AO (RFC 5925) as the intended secure-transport upgrade [Confirmed] — https://www.rfc-editor.org/rfc/rfc8210

UDP transport mode for rpki-rtr

not found in the located RFC text; UDP/323 appears to be a reservation alongside the TCP assignment rather than an active protocol mode [Likely] — https://www.rfc-editor.org/rfc/rfc8210