353
Summary
- // typical exposure
- Internal-only — As a plausible Novell/eDirectory-style directory-authentication channel with no documented public-facing role and negligible modern prevalence, 353/tcp fits services that should never face the public internet.
- // analyst note
- essentially never observed open in internet scans; treat an open 353 as legacy Novell directory infrastructure or an anomaly worth investigating.
- // if you see it open
- Directory-authentication service plausibly tied to legacy Novell NDS/eDirectory (inferred from the IANA short name, not registry-confirmed); should be restricted to trusted internal network infrastructure, never exposed to the public internet. An exposed instance could plausibly enable directory enumeration or authentication brute-forcing, though no specific CVE was located for this port. Essentially never seen open in internet scan telemetry.
About port 353/tcp.
Port 353/tcp is registered with IANA under the short name ndsauth; it most plausibly carries authentication traffic tied to Novell Directory Services (NDS) / NetIQ eDirectory — a plausible inference from the name, not a registry-confirmed fact — and, like other directory-authentication channels, it should stay internal-only rather than ever being exposed to the public internet.
The IANA Service Name and Transport Protocol Port Number Registry lists 353 as dual-registered on both TCP and UDP under the same ndsauth name, description "NDSAUTH," assignee Jayakumar Ramalingam, with a blank Reference field — no RFC defines the wire protocol, and no independent documentation of the exact authentication handshake was found.
NDS (later rebranded NetIQ eDirectory) is Novell's enterprise directory service, functionally comparable to LDAP or Active Directory in that it centralizes authentication and object lookups for a network. The Novell/eDirectory association is a plausible inference from the IANA short name ndsauth, not a fact the registry itself confirms — no primary-source Novell/NetIQ document describing the exact wire protocol on this port was located in this pass. As with other directory-authentication ports, this kind of service is meant to be reachable only by trusted infrastructure inside an organization's network, not from arbitrary internet hosts.
Internet-scan telemetry (nmap-services) shows this port is essentially never seen open: observed frequency is roughly 0.00005 on TCP and 0.00026 on UDP, consistent with NDS/eDirectory being legacy, declining enterprise software rather than something with broad public exposure.
- IANA assignment
ndsauth— "NDSAUTH"; reference (blank — no RFC cited); assignee Jayakumar Ramalingam; dual-registered 353/tcp + 353/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 353/tcp ≈ 0.00005; 353/udp ≈ 0.000264 [Confirmed] — nmap-services file
- Related ports
- 524/tcp (ncp — Novell NetWare Core Protocol), 389 (LDAP, comparable directory-auth role)
Primary use
plausibly Novell Directory Services (NDS) / NetIQ eDirectory authentication traffic, inferred from the IANA short name; exact protocol semantics not documented in a located primary source
Other/unofficial uses
none independently verified [Unknown]
Security implications
legitimate use should be restricted to trusted internal directory infrastructure; an exposed instance could enable enumeration/brute-force against the underlying directory service, though no specific CVE was located
Typically seen on
legacy Novell/NetIQ eDirectory (NDS) environments, if seen at all [Unknown]
- Analyst note
- essentially never observed open in internet scans; treat an open 353 as legacy Novell directory infrastructure or an anomaly worth investigating.
About port 353/udp.
Port 353/udp is registered with IANA under the short name ndsauth; it most plausibly carries authentication traffic tied to Novell Directory Services (NDS), and — like other directory-authentication channels — it should stay internal-only rather than be exposed to the public internet.
IANA's Service Names and Port Numbers Registry lists 353/udp as ndsauth, description "NDSAUTH," assignee Jayakumar Ramalingam, with a blank Reference column and an identical dual registration on 353/tcp. No RFC or other formal specification is cited for this entry, and IANA's public registry does not publish a per-entry assignment date, so no registration date can be recorded.
The name strongly suggests a role in Novell/NetIQ eDirectory (formerly NDS) authentication, which historically used a cluster of ports in this general range for directory and login traffic. No primary-source Novell/NetIQ document describing the exact wire protocol on this port was located in this pass, so the protocol's precise behavior is Unknown beyond the IANA short name — this is a plausible inference, not a confirmed fact.
Real-world usage appears negligible today. nmap's nmap-services frequency data shows both 353/tcp and 353/udp open on well under 0.1% of scanned hosts historically, and no CVE, exploit, or malware family tied specifically to this port was found. Community-sourced sightings of software using this port could not be surfaced (search tooling hit a session budget limit and bot-detection walls on several engines), so common applications are left unspecified rather than guessed.
- IANA assignment
ndsauth— "NDSAUTH"; reference (blank — none in registry); assignee Jayakumar Ramalingam; dual-registered 353/tcp + 353/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 353/tcp ≈ 0.000050 (~0.005%), 353/udp ≈ 0.000264 (~0.026%) [Confirmed] — nmap-services file
- Related ports
- 353/tcp (identical dual IANA registration)
Primary use
plausibly Novell Directory Services (NDS/eDirectory) authentication traffic, inferred from the IANA short name; exact protocol semantics not documented in a located primary source
Other/unofficial uses
none found in this pass [Unknown]
Security implications
no CVE/exploit/malware family identified for this port; very low observed prevalence; treat an open instance as a legacy-Novell indicator or anomaly
Typically seen on
legacy Novell/NetIQ eDirectory (NDS) environments, if seen at all [Unknown]
- Analyst note
- registry facts (name, description, assignee, blank reference, dual registration) are Confirmed directly from IANA; the protocol's actual behavior and any modern software using it are Unknown and should not be asserted beyond the short name.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ndsauth | UDP | — | 0.03% |
| ndsauth | TCP | — | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.