348
Summary
- // typical exposure
- Restricted (trusted networks only) — The IANA description identifies this as a network-device management protocol, a class that should be limited to trusted admin networks or VPN access rather than exposed to the public internet.
- // analyst note
- Cabletron Systems dissolved into Enterasys Networks in 2001; an open 348/tcp today is more likely stale, decoy, or anomalous than a live management session — investigate rather than assume legitimacy.
- // if you see it open
- No CVEs, scanning campaigns, or malware associations tied to port 348 were found. As a device-management protocol it should be restricted to trusted admin networks/VPN if still in use anywhere, not exposed to the public internet. Cabletron Systems dissolved into Enterasys Networks in 2001, so legitimate traffic today would be rare; an open port is more plausibly stale, misconfigured, or anomalous.
About port 348/tcp.
Port 348/tcp carries csi-sgwp, IANA's registered name for the Cabletron Management Protocol; it is a legacy network-device management service that has no business facing the public internet and should stay restricted to trusted management networks wherever it still exists.
IANA registers 348 on both TCP and UDP under the identical service name csi-sgwp and the description "Cabletron Management Protocol," with the Assignee, Contact, Reference, and date columns all left blank in the registry — there is no RFC or vendor specification cited. Cabletron Systems was a networking-hardware vendor (hubs and switches, notably the Systems Manager/SPECTRUM NMS line) active mainly in the 1990s; the company merged into Enterasys Networks in 2001, and no independent technical documentation of the actual csi-sgwp wire protocol could be located.
No CVEs, scanning campaigns, or malware associations tied specifically to port 348 turned up in this pass, and the port does not appear on Wikipedia's list of common TCP/UDP ports. Given Cabletron's 2001 dissolution as a brand, legitimate csi-sgwp traffic today would be rare to nonexistent, so an open 348/tcp is more plausibly a stale device, a misconfiguration, or worth flagging as anomalous than an active management session.
- IANA assignment
csi-sgwp— "Cabletron Management Protocol"; reference (blank — no RFC cited); assignee blank; dual-registered 348/tcp + 348/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no nmap-services open-frequency or scanning data could be located for this port in this pass [Unknown]
- Related ports
- no confirmed direct relation; conceptually adjacent to other vendor/NMS management protocols (e.g. SNMP 161/162) [Unknown]
Primary use
Cabletron Management Protocol — legacy network-device management service from Cabletron Systems; no RFC or public spec found
Other/unofficial uses
none documented [Unknown]
Security implications
no CVEs or malware associations found; as a legacy device-management protocol it should be restricted rather than internet-facing if still in use [Unknown/Likely]
Typically seen on
legacy Cabletron/Enterasys-managed network hardware, if any remain in service [Likely]
- Analyst note
- Cabletron Systems dissolved into Enterasys Networks in 2001; an open 348/tcp today is more likely stale, decoy, or anomalous than a live management session — investigate rather than assume legitimacy.
About port 348/udp.
Port 348/udp is registered with IANA as csi-sgwp, described only as "Cabletron Management Protocol"; if it appears at all today it belongs on an internal network-management segment, not exposed to the public internet.
The IANA registry lists no assignee and a blank reference field, and the entry is dual-registered on both 348/tcp and 348/udp. Cabletron Systems was a networking-hardware vendor that merged into Enterasys Networks in 2001; Enterasys was later acquired by Extreme Networks. This is a legacy vendor-management assignment rather than an actively maintained protocol.
No RFC, vendor manual, or community writeup describing the wire protocol in detail could be located in this pass, and no scan-prevalence, honeypot, or threat-intel data for the port was found either (two secondary port-database lookups failed to load). Given the port's tie to a defunct vendor's proprietary management scheme, real-world traffic is likely rare, but that is an inference rather than a sourced observation.
- IANA assignment
csi-sgwp— "Cabletron Management Protocol"; reference (blank); assignee (none listed); dual-registered 348/tcp + 348/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 673–674); IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no nmap-services or scan-telemetry figures located for 348/udp in this pass [Unknown]
- Related ports
- no confirmed relation — 341–343 are Unassigned, and 344–347 are unrelated assignments (
pdap,pawserv,zserv,fatserv); contrast modern SNMP (161/162) as a vendor-management analog [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
Primary use
proprietary Cabletron Systems network-management protocol for its switching/routing gear; no public protocol spec located
Other/unofficial uses
Unknown — no vendor documentation, forum, or blog attributing any specific modern software to this port [Unknown]
Security implications
no CVEs or advisories found referencing this port; management protocols of this class should be confined to trusted/internal networks if still in service [Unknown/Likely]
Typically seen on
legacy Cabletron/Enterasys network-management hosts, if still in service; otherwise a rare anomaly [Likely]
- Analyst note
- essentially no independent verification exists beyond the IANA registry entry; treat traffic on this port as noteworthy given the defunct-vendor association.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| csi-sgwp | UDP | Cabletron Management Protocol | 0.05% |
| csi-sgwp | TCP | Cabletron Management Protocol | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.