351
Summary
- // typical exposure
- Internal-only — MATIP Type B tunnels airline back-office/reservation traffic between carrier systems and was never designed for public internet exposure, and the co-registered bhoetty name has no legitimate documented use either.
- // analyst note
- A responsive port 351 outside airline-industry infrastructure has no confirmed benign explanation on record — verify locally before assuming a specific application.
- // if you see it open
- Narrow airline-industry protocol (MATIP) with no legitimate public-facing use; a second unofficial 'bhoetty' entry shares the port with no documented application or known exploit history. No CVEs or scanning/exposure writeups were found for port 351 in this research pass.
About port 351/tcp.
Port 351/tcp is officially assigned by IANA to matip-type-b ("MATIP Type B," a protocol for tunneling airline Type B traffic over IP per RFC 2351); it is a narrow, airline-industry protocol with no documented general-purpose or consumer use, so it should stay internal to carrier back-office networks rather than be exposed to the public internet.
IANA's registry also carries a second, informally-noted service name sharing the same port: bhoetty. Its entire registry text reads "This entry records an unassigned but widespread use (added 5/21/97)," assignee John Kelly, with a blank reference field and no protocol description — its practical meaning today is effectively undocumented.
MATIP (Mapping of Airline Traffic over Internet Protocol) Type B is defined in RFC 2351 (Alain Robert, 1998). It tunnels legacy Type B teletype-style messages — the traditional airline reservation and operations messaging format — over IP networks, largely replacing older X.25 links between carrier systems and reservation/back-office infrastructure.
No CVEs, malware associations, or public scanning/exposure writeups (Shodan, Censys, honeypot reports, or community sighting threads) were found for port 351 in this research pass. Given the tight airline-industry scope of matip-type-b and the undocumented nature of bhoetty, an analyst seeing traffic on 351/tcp should verify locally rather than assume a specific application.
- IANA assignment
matip-type-b— "MATIP Type B," reference RFC2351, assignee Alain Robert; dual-registered 351/tcp + 351/udp [Confirmed] — IANA service-names-port-numbers registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no nmap-services or scanning telemetry found for port 351 in this pass [Unknown]
- Related ports
- 351/udp — both service names on this port are dual-registered there (
matip-type-b, identical "MATIP Type B" description, assignee [Alain_Robert], reference [RFC2351]; andbhoetty, same "unassigned but widespread use" note, assignee [John_Kelly]); plus 350/tcp + 350/udp —matip-type-a("MATIP Type A"), same assignee [Alain_Robert] and same [RFC2351] reference, i.e. the other MATIP type defined by that RFC [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry matip-type-b 351/udp; the IANA Service Name and Transport Protocol Port Number Registry bhoetty 351/udp; the IANA Service Name and Transport Protocol Port Number Registry matip-type-a 350/tcp
Primary use
MATIP Type B — tunnels airline Type B messages over IP per RFC 2351, replacing legacy X.25 airline links
Other/unofficial uses
bhoetty — no documented application beyond the bare IANA name [Unknown]
Security implications
narrow airline-industry protocol with no legitimate public-facing use; no CVEs or known exploits found for either registered name [Likely]
Typically seen on
airline reservation/back-office systems using MATIP Type B; otherwise anomalous or tied to the undocumented bhoetty entry [Likely]
- Secondary IANA entry
bhoetty— "This entry records an unassigned but widespread use (added 5/21/97)," assignee John Kelly, blank reference field; dual-registered 351/tcp + 351/udp [Confirmed] — IANA service-names-port-numbers registry- Analyst note
- A responsive port 351 outside airline-industry infrastructure has no confirmed benign explanation on record — verify locally before assuming a specific application.
About port 351/udp.
Port 351/udp carries two unrelated IANA registrations rather than one clear service, so it should stay confined to closed industry or internal networks rather than be exposed to the public internet.
The primary entry, matip-type-b, is MATIP Type B (RFC 2351, 1998), a legacy protocol that maps IATA/ARINC "Type B" airline telegraphy-style messages — reservations and flight-ops teletype traffic — onto TCP/IP in place of older X.25 airline networks such as SITA and ARINC. It is dual-registered on both 351/tcp and 351/udp, assignee Alain Robert, and is industry-specific middleware rather than general-purpose internet traffic.
The second entry, bhoetty, is an informal 1997 registration (assignee John Kelly) that IANA itself annotates only as "unassigned but widespread use (added 5/21/97)," with no RFC reference and no protocol documentation found in this research pass. It is best treated as a legacy /etc/services-style artifact rather than a documented service.
No CVEs, malware-family port lists, or scanning/abuse-database entries for 351/udp were located. Scan prevalence is low but nonzero: the nmap-services dataset records an open-frequency of 0.000313 for matip-type-b on 351/udp, roughly three hundredths of one percent of sampled hosts. The threat-intelligence picture should still read as Unknown rather than "no risk," since the web-research angle's search budget was exhausted before scanning and community-sightings checks could be completed.
- IANA assignment 1
matip-type-b— "MATIP Type B"; reference RFC 2351; assignee Alain Robert; dual-registered 351/tcp + 351/udp [Confirmed] — IANA the IANA Service Name and Transport Protocol Port Number Registry- IANA assignment 2
bhoetty— "bhoetty"; reference blank; assignee John Kelly; IANA notes "unassigned but widespread use (added 5/21/97)" [Confirmed] — IANA the IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed] — IANA System Ports definition
- Prevalence
- the nmap-services dataset records
matip-type-bon 351/udp with an open-frequency of 0.000313 (~0.03% of sampled hosts) against 0.000013 on 351/tcp; the dataset's own comment for the port reads "MATIP Type B or bhoetty", independently corroborating the dual registration[Confirmed] — nmap-services dataset - Related ports
- none specifically documented as a cluster with 351 [Unknown]
Primary use
MATIP Type B (RFC 2351) — maps IATA/ARINC airline Type B telegraphy traffic onto IP, replacing X.25 airline networks
Other/unofficial uses
bhoetty — no protocol specification or vendor documentation found; legacy informal registration only
Security implications
confined to closed airline-industry (ARINC/SITA) network gateways by design; no CVEs or malware associations found, but scanning/abuse-database sources were not checked this pass
Typically seen on
airline industry back-office/telex-gateway systems (ARINC/SITA network middleware); otherwise anomalous
- Analyst note
- an open 351/udp outside an airline-industry network context has no known legitimate use and should be investigated rather than assumed benign.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| matip-type-b | UDP | MATIP Type B or bhoetty | 0.03% |
| matip-type-b | TCP | MATIP Type B or bhoetty also safetp | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.