324

Port 324/tcp carries the RPKI-to-Router (RPKI-RTR) protocol secured over TLS; it should generally stay restricted to trusted paths between routers and RPKI validators rather than being exposed openly to the public internet.

IANA registers 324/tcp as rpki-rtr-tls, "Resource PKI to Router Protocol over TLS," assignee IESG, reference RFC 6810; 324/udp is Reserved with no service name assigned. RFC 6810 (2013) defined RPKI-RTR version 0 with TLS as an optional secure transport on this port; RFC 8210 (2017) updated the protocol to version 1 and kept port 324 for the TLS variant. A version-2 draft (draft-ietf-sidrops-8210bis) is in progress but has not obsoleted RFC 8210.

RPKI-RTR lets a router pull validated Route Origin Authorization (ROA) and prefix-origin data from an RPKI relying-party cache or validator, feeding Route Origin Validation (ROV) decisions in BGP. Port 324 specifically identifies the TLS-wrapped variant, distinct from plaintext RTR on port 323 or SSH-wrapped RTR deployments.

NLnet Labs' Routinator, a widely used RPKI relying-party validator, natively supports RTR-over-TLS on this port and documents it as most useful when RTR data is proxied across the public internet (for example via their RTRTR tool). Vendor documentation notes that only a small number of routers actually implement the TLS variant in practice, with plaintext RTR or SSH-secured RTR being more commonly deployed.

No dated Shodan, Censys, or Shadowserver source was found quantifying internet-wide exposure or scanning activity for 324/tcp specifically, so real-world prevalence and open-port frequency for this port are Unknown.

IANA assignment

rpki-rtr-tls — "Resource PKI to Router Protocol over TLS"; reference RFC 6810; assignee [IESG]; 324/udp Reserved (no service name) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)

Range class

well-known (0–1023)

Prevalence

no internet-wide scan data (Shodan/Censys/Shadowserver) located for this port [Unknown]

Related ports

323/tcp (plaintext RTR, same protocol family)

Primary use

RPKI-to-Router protocol (RTR) over TLS — routers fetch validated ROA/prefix-origin data from an RPKI relying-party cache for BGP Route Origin Validation

Other/unofficial uses

none identified beyond the RTR-TLS role [Unknown]

Security implications

intended for validator-to-router links, best kept off the open internet or authenticated/allowlisted when it must cross public paths; TLS variant is less commonly implemented than plaintext (323) or SSH-wrapped RTR

Typically seen on

RPKI relying-party validators (e.g. Routinator) and routers configured for RPKI-based BGP origin validation

Analyst note

Protocol version evolved from RFC 6810 (v0) to RFC 8210 (v1) while keeping port 324 for TLS; a draft v2 (draft-ietf-sidrops-8210bis) has not superseded RFC 8210 as of this writing.

Port 324/udp carries no IANA-assigned service — the registry lists it simply as Reserved, with no service name, description, assignee, or reference — so it does not belong on the public internet as an expected listener at all; any UDP traffic seen on it is more likely scanning noise or misconfiguration than a real service.

The corresponding tcp/324 port is registered to rpki-rtr-tls (RFC 6810), the TLS-secured RPKI-to-Router (RTR) protocol that lets routers pull validated Route Origin Authorization data from an RPKI validating cache for BGP origin validation. RTR is TCP/TLS-only — no UDP transport is defined in RFC 6810 or its successor RFC 8210 — which is consistent with IANA leaving the UDP counterpart unassigned rather than mirroring the TCP registration.

RTR is implemented by RPKI validating-cache software such as NLnet Labs' Routinator, the RIPE NCC RPKI Validator, and StayRTR/GoRTR, all of which speak TCP to routers, never UDP. SANS ISC's port-324 activity page (checked 2026-07-24) shows only routine, low-volume background-scan traffic — a handful of source IPs and up to roughly 68 hits in recent rolling windows — consistent with generic internet-wide scanning rather than a campaign aimed at this port specifically.

No CVEs or malware families tied specifically to port 324 (tcp or udp) turned up in the sources checked, though that absence is not exhaustively confirmed. Because no legitimate protocol is defined for the UDP side, a responsive 324/udp should be treated as an anomaly worth a closer look rather than dismissed as expected traffic.

IANA assignment

Reserved — no service name, description, assignee, contact, or reference on 324/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 660; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Range class

well-known (0–1023)

Prevalence/scanning

SANS ISC port/324 activity shows routine low-volume background scanning (a handful of source IPs, up to ~68 hits in rolling windows), consistent with generic internet noise rather than a distinct campaign [Confirmed] — https://isc.sans.edu/data/port/324

Protocol context

RTR (RPKI-to-Router) carries validated ROA data from RPKI caches to routers for BGP origin validation; TCP/TLS only — no UDP transport defined in RFC 6810 or RFC 8210

Common software

RTR is implemented by RPKI validating-cache software (Routinator, RIPE NCC RPKI Validator, StayRTR/GoRTR) — all TCP-based

Malware/CVE association

none found tied specifically to port 324 (tcp or udp) in sources checked; absence not exhaustively confirmed [Unknown]

Typically seen on

not expected on any legitimate host; a responsive UDP/324 is anomalous — scan noise, misconfiguration, or non-standard software

Paired tcp/324 assignment

rpki-rtr-tls, "Resource PKI to Router Protocol over TLS," Reference RFC 6810, assignee/contact [IESG]/[IETF_Chair] [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv, https://www.rfc-editor.org/rfc/rfc6810.html

Analyst note

treat responsive UDP/324 as noise/misconfiguration rather than evidence of RTR activity, since RTR itself never uses UDP.