376
Summary
- // typical exposure
- Internal-only — Envoy is a local-network discovery protocol by design (analogous to other LAN-scoped discovery services of its era) and was never intended to answer requests from the public internet.
- // analyst note
- A responsive port 376 is an uncommon sighting today and most plausibly indicates legacy AmigaOS/Envoy networking or emulation rather than a mainstream service; treat unexplained exposure as worth investigating.
- // if you see it open
- Envoy is a local-network discovery protocol, not designed to be reachable from the public internet. No documented CVE, malware, trojan, or notable scanning-campaign association was found for this port in the sources searched.
About port 376/tcp.
Port 376/tcp carries nip, the Amiga Envoy Network Inquiry Protocol; it is a legacy local-network discovery service that should stay internal-only rather than be reachable from the public internet.
IANA's registry lists the service name nip with description "Amiga Envoy Network Inquiry Protocol," dual-registered on both 376/tcp and 376/udp with identical metadata, assignee and contact Heinz Wrobel, a blank Registration Date, and a Modification Date of 2020-10-02. That date is the registry record's own last-modified date, not the protocol's origin — no RFC or other reference is cited for this entry, so the Reference field is correctly blank.
Envoy was Commodore/AmigaOS's network device-inquiry and service-discovery mechanism, roughly analogous in role to other 1990s-era LAN discovery protocols (contemporaries of early AppleTalk/NetBIOS-style name resolution). The IANA registration formalizes a port number for that traffic long after AmigaOS's active era, which is consistent with the low, largely historical prevalence of the assignment today.
No credible vendor documentation, blog post, or forum thread was found naming a specific modern application or client that generates traffic on port 376; aggregator "port lookup" sites only restate the IANA description without independent sightings, so no software names are asserted here. No documented malware, trojan, or scanning-campaign association was found either.
- IANA assignment
nip— "Amiga Envoy Network Inquiry Protocol"; reference (blank — no RFC cited in IANA registry); assignee/contact Heinz Wrobel; Registration Date blank, Modification Date 2020-10-02; dual-registered 376/tcp + 376/udp[Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv- Range class
- well-known (0–1023)
- Prevalence
- no telemetry/nmap-services frequency figure located for this entry; treated as low based on the protocol's legacy, niche (AmigaOS) origin [Unknown]
- Related ports
- 376/udp (identical dual registration); no other closely related assignments identified
Primary use
legacy AmigaOS Envoy network device-inquiry / service-discovery protocol, formalized in IANA's registry decades after the protocol's active era [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv, https://en.wikipedia.org/wiki/Amiga_support_and_maintenance_software
Other/unofficial uses
none identified; no modern software credibly reported using this port [Unknown]
Security implications
local-network discovery service that should not be internet-facing; no documented CVE, malware, or scanning-campaign association found
Typically seen on
legacy/retro AmigaOS hosts or emulation running Envoy networking software
- Analyst note
- A responsive port 376 is an uncommon sighting today and most plausibly indicates legacy AmigaOS/Envoy networking or emulation rather than a mainstream service; treat unexplained exposure as worth investigating.
About port 376/udp.
Port 376/udp is IANA-registered as nip, the Amiga Envoy Network Inquiry Protocol — an obsolete 1990s Amiga networking-discovery service, not something that belongs on the modern public internet.
The IANA registry lists assignee Heinz_Wrobel and a blank Reference field (no RFC is cited), with the identical service name and description dual-registered on both 376/tcp and 376/udp. The registry's most recent modification date on file is 2020-10-02.
Envoy was Amiga's 1990s networking stack, providing NetBIOS/AppleTalk-style file and printer sharing over TCP/IP, commonly deployed with Ethernet hardware such as the Ariadne board. nip is described in community sources as Envoy's discovery/query component, though the protocol itself is largely undocumented beyond the bare IANA assignment.
Amiga Envoy is long obsolete, and no credible current exploitation, scanning campaign, or malware family is verifiably tied to 376/udp. No malware association is confirmed for this port — no named family, sample, or incident was found — so an open 376/udp is best read as a legacy or anomalous listener rather than a threat indicator.
- IANA assignment
nip— "Amiga Envoy Network Inquiry Protocol"; reference (blank — no RFC cited); assignee Heinz_Wrobel; dual-registered 376/tcp + 376/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, modified 2020-10-02)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 376/udp ≈ 0.00112 — very low (roughly 1 in 1,000 scanned hosts in the nmap-services sample) [Likely] — nmap-services dataset
- Related ports
- 376/tcp (identical service name and description, dual-registered) [Confirmed]
Primary use
Amiga Envoy network discovery/query service (NIP), part of a 1990s Amiga NetBIOS/AppleTalk-like file-and-printer-sharing stack [Likely] — https://mail-index.netbsd.org/port-amiga/2002/02/19/0001.html, https://www.pcreview.co.uk/threads/ports-376-nip-and-1434-ms-sql-m.1735079/
Other/unofficial uses
none credibly documented beyond Amiga Envoy itself [Unknown]
Security implications
essentially never legitimately open today; Amiga Envoy is obsolete; no malware association is confirmed for 376/udp [Unknown]
Typically seen on
legacy Amiga systems running Envoy (e.g. with Ariadne-brand Ethernet cards) [Likely]; otherwise an anomaly on modern networks [Unknown]
- Analyst note
- an open 376/udp is rare and legacy in nature — investigate as a possible decoy or anomaly rather than assuming benign traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| nip | UDP | Amiga Envoy Network Inquiry Proto | 0.11% |
| nip | TCP | Amiga Envoy Network Inquiry Protocol | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.