350

Port 350/tcp is registered with IANA as matip-type-a with the description "MATIP Type A," assignee Alain Robert, and a reference of [RFC2351] — making it the only entry in its batch whose IANA Reference field is not blank (dual-registered on TCP and UDP). MATIP (Mapping of Airline Traffic over IP, RFC 2351, May 1998) encapsulates legacy airline-specific synchronous protocols — the ALC, P1024B/P1024C, and ASCU traffic historically carried over X.25 — inside TCP. RFC 2351 allocates MATIP Type A to TCP port 350 and Type B to TCP port 351, with the traffic type selected according to the TCP port: Type A is conversational/session-oriented traffic (reservations, ticketing) and Type B is message-based traffic. A MATIP session is established above the TCP connection to identify traffic characteristics such as subtype, multiplexing, data header, and character set, and because no keep-alive is defined, session timeout relies on the underlying TCP timers. Security-wise RFC 2351 notes that authentication relies on external mechanisms using static identifiers or apparently clear-text passwords — neither of which provides sound security — and mentions IPsec only as optional, so the protocol is plaintext by design. However, it lives on private airline and GDS networks (SITA, ARINC) rather than the public internet, so its public footprint is minimal, and an internet-facing instance would be a serious concern for an airline network. For an analyst, an open 350 indicates airline/GDS networking and is almost never legitimately on the public internet, so any internet-facing instance should be treated as a misconfiguration or honeypot.

IANA assignment

matip-type-a — "MATIP Type A"; reference [RFC2351] (the only non-blank reference in this batch); assignee Alain Robert; dual-registered 350/tcp + 350/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000025 (de-facto) [Well-established] — nmap-services file

Related ports

351 (matip-type-b — message-based)

Primary use

airline reservation/ticketing/messaging traffic over IP — Type A conversational (RFC 2351)

Other/unofficial uses

none meaningful outside airline/GDS networks [Well-established]

Security implications

plaintext; weak/external auth per RFC 2351; lives on private SITA/ARINC nets; minimal public footprint [Well-established]

Typically seen on

airline/GDS hosts (SITA/ARINC private networks)

Analyst note

An open 350 indicates airline/GDS networking — almost never legitimately on the public internet; treat any internet-facing instance as a misconfiguration or honeypot.

Port 350/udp is IANA-registered under the service name matip-type-a ("MATIP Type A"), but the only specification defining this service, RFC 2351, allocates TCP port 350 exclusively and never mentions a UDP transport — so 350/udp has no documented protocol of its own and should not be expected to carry legitimate traffic anywhere, public or internal.

MATIP (Mapping of Airline Traffic over Internet Protocol) Type A is a legacy airline-industry protocol carrying interactive query/response traffic between a travel-agency or airline-office terminal and a central reservation/ticketing host, plus host-to-host airline system communication, per RFC 2351 (Alain Robert, 1998).

The IANA registry lists port 350 as registered for both tcp and udp under the same service name and reference, which is a known registry artifact from how older assignments got mirrored across both transports even when the source RFC is TCP-only. Research found no vendor documentation, blog post, or forum report describing real-world traffic on UDP/350 specifically.

Because no UDP behavior is documented, a responsive 350/udp is best treated as an anomaly worth investigating rather than a recognized airline-industry endpoint — it could reflect a misconfigured mirror of the TCP service, a probe response, or an unrelated custom use of the port number.

IANA assignment

matip-type-a — "MATIP Type A"; reference RFC 2351; assignee Alain Robert; dual-registered 350/tcp + 350/udp [Confirmed] — IANA service-names-port-numbers registry

Range class

well-known (0–1023) [Confirmed]

Prevalence

not established in this research pass; no nmap-services frequency data cited [Unknown]

Related ports

351/tcp (MATIP Type B, per RFC 2351)

Primary use

legacy airline reservation/ticketing protocol (MATIP Type A) per RFC 2351; the RFC allocates TCP only and defines no UDP behavior

Other/unofficial uses

none documented for the UDP variant [Unknown]

Security implications

UDP transport has no documented protocol behavior; a responsive 350/udp should be treated as anomalous; no CVE or malware association found for this port on either transport

Typically seen on

legacy airline-industry systems via 350/tcp; the UDP variant is not expected on any host [Likely]

Analyst note

Treat an open 350/udp as unexpected — investigate as a misconfiguration, mirrored/probe artifact, or unrelated custom use rather than assuming legitimate MATIP traffic.