346
Summary
- // typical exposure
- Internal-only — The registered name and community association point to routing-daemon control-plane traffic, which should stay on internal/management networks rather than face the public internet.
- // analyst note
- registry data for 346/tcp is sparse and largely blank; treat any observed traffic as worth investigating rather than assuming a confirmed Zebra-suite binding.
- // if you see it open
- No CVEs or malware associations found. As a routing-daemon control assignment it would belong on internal/management networks only if in use; modern FRR/Quagga zebra communication typically uses a Unix domain socket or a distinct 'vty' management port rather than 346, so live usage on 346 is unconfirmed.
About port 346/tcp.
Port 346/tcp is registered with IANA as zserv ("Zebra server"); it is a legacy routing-control assignment that would belong internal-only rather than facing the public internet, though direct evidence of live traffic on it is sparse. The IANA registry lists only the service name and description — assignee, contact, registration date, and reference fields are all blank, and the same name/description pair is dual-registered on 346/udp.
The name zserv is widely understood in the networking community to reference the "zebra" core daemon of the GNU Zebra routing-software suite, later carried forward into Quagga and FRRouting (FRR); other routing-protocol daemons (ripd, ospfd, bgpd, etc.) connect to zebra for RIB and interface state. This is a community interpretation of the registered name, not a fact documented in the IANA registry itself.
Research could not confirm that modern zebra/FRR software actually binds TCP or UDP 346 for that purpose — current FRR/Quagga zebra client communication typically uses a Unix domain socket or a distinct "vty" management port, not 346. No dated vendor doc, blog, or forum post was found tying live traffic to this port, and no scanning/threat-intel writeups (SANS ISC, Shodan, malware-port lists) mention it.
- IANA assignment
zserv— "Zebra server"; reference (blank — no RFC cited); assignee (blank); dual-registered 346/tcp + 346/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no nmap-services or scanning-prevalence data located for this port in this pass [Unknown]
- Related ports
- 2600-series "vty" management ports used by zebra/FRR for daemon management (distinct from 346) [Likely]
Primary use
registered name/description associated by the community with the "zebra" core process of the GNU Zebra routing-software suite (predecessor to Quagga/FRRouting) that other routing daemons connect to for RIB/interface state
Other/unofficial uses
none verifiably documented [Unknown]
Security implications
as a routing-control assignment it would be internal-only if in use; no CVEs or malware associations found [Unknown/Likely]
Typically seen on
legacy or historical GNU Zebra/Quagga-family routing hosts, if used at all; no confirmed live sightings [Unknown]
- Analyst note
- registry data for 346/tcp is sparse and largely blank; treat any observed traffic as worth investigating rather than assuming a confirmed Zebra-suite binding.
About port 346/udp.
Port 346/udp is registered with IANA as zserv ("Zebra server"); it is a legacy routing-control assignment that would belong internal-only rather than facing the public internet, though direct evidence of live traffic on it is sparse.
IANA registers 346 as zserv — "Zebra server" — on both TCP and UDP, with the Assignee and Reference columns left blank; no RFC or other reference document is cited for this entry.
The service name ties to GNU Zebra, the routing-management daemon suite whose lineage continued as Quagga and later FRRouting (FRR). Historically, zserv denoted the internal control channel that routing-protocol daemons (for BGP, OSPF, RIP, etc.) used to talk to the core route-manager process, not a protocol meant to be reached from outside the host.
No dated scanning-prevalence figures, malware associations, or CVE records for port 346 turned up in the sources checked for this pass; several general port-lookup sites returned errors rather than content, so exposure and abuse data here are genuinely absent rather than omitted.
- IANA assignment
zserv— "Zebra server"; reference (blank — none cited); assignee (blank — none listed); dual-registered 346/tcp + 346/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no scan-frequency or telemetry data found in the sources checked this pass [Unknown]
- Related ports
- 346/tcp (identical
zservregistration, dual-registered) [Confirmed]
Primary use
internal control interface (zserv) used by GNU Zebra routing daemons to communicate with the core route manager
Other/unofficial uses
none identified in researched sources [Unknown]
Security implications
internal routing-daemon control channel; a responsive instance is a fingerprint for GNU Zebra/Quagga/FRR rather than a service meant for public exposure; no CVEs or malware associations found
Typically seen on
legacy or niche hosts running GNU Zebra, Quagga, or FRRouting with the classic zserv interface enabled
- Analyst note
- treat an open 346/udp as a routing-daemon internal-interface signature; it should not be reachable from outside the management/control network.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| zserv | UDP | Zebra server | 0.04% |
| zserv | TCP | Zebra server | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.