379
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — The is99c service implements a legacy 1990s CDMA modem-client protocol with no known modern deployment, so a host answering on port 379 is unexpected and warrants investigation rather than being treated as routine infrastructure.
- // analyst note
- an open port 379 has no plausible modern legitimate use; treat a response as worth investigating rather than routine.
- // if you see it open
- No credible community-sourced evidence of real-world traffic, specific vendor software, or verified malware ties to this port. Some generic port-database sites (e.g. AuditMyPC) list 379 in unspecified 'virus/Trojan' port lists, but no named malware family, CVE, or credible security-vendor writeup was found. The underlying is99c protocol is a legacy 1990s CDMA modem-client standard with no known modern deployment, so an open port 379 is an anomaly worth investigating rather than a routine service.
About port 379/tcp.
Port 379/tcp carries is99c, the IANA-registered client side of the legacy TIA/EIA/IS-99 modem-over-CDMA protocol; it has no known modern deployment, so it should not be exposed to the public internet — or expected to appear at all — on a current network [Confirmed] — IANA registry.
The IANA Service Name and Transport Protocol Port Number Registry lists 379 as dual-registered on TCP and UDP for is99c, described only as "TIA/EIA/IS-99 modem client." The Assignee, Contact, Reference, and Registration Date columns are all blank in the registry, so no RFC or standards document is cited and no registrant is named [Confirmed] — IANA registry.
TIA/EIA/IS-99 is a Telecommunications Industry Association standard for circuit-switched data service over CDMA cellular networks, an early-1990s-era way to run modem-style data sessions across a cellular link. Port 380/tcp,udp is registered as is99s, the server-side counterpart, forming a client/server pair [Confirmed] — IANA registry.
No credible community-sourced evidence of real-world traffic, specific vendor software, or malware using port 379 was found; secondary port-lookup sites only restate the IANA label without independent verification, and no Shodan/Censys-style scan-prevalence data was located [Unknown] — port-database review.
- Exposure
- the
is99cprotocol has no known modern deployment; a host answering on 379/tcp is unexpected rather than routine and merits investigation [Likely] — IANA registry, port-database review - Malware association
- some generic port-database sites tag 379 as appearing in unspecified "virus/Trojan" lists, but no named malware family, CVE, or credible security-vendor writeup ties a specific threat to this port [Unknown] — AuditMyPC port pages
- Fingerprint value
- because the protocol is obsolete and essentially unseen, an open port 379 is more useful as an anomaly signal than as evidence of any specific service [Likely] — analyst inference from registry + prevalence context
- IANA assignment
is99c— "TIA/EIA/IS-99 modem client"; Assignee, Contact, Reference, and Registration Date all blank; dual-registered 379/tcp + 379/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no scan-prevalence (Shodan/Censys/nmap-services frequency) data located in this pass [Unknown]
- Related ports
- 380/tcp,udp (
is99s, the server counterpart) [Confirmed] — IANA registry
Primary use
client side of the TIA/EIA/IS-99 modem-over-CDMA circuit-switched data protocol; server counterpart is is99s on port 380
Other/unofficial uses
none credibly documented
Security implications
essentially never legitimately open today; some generic "Trojan port list" mentions exist but no named malware family or CVE was verified
Typically seen on
legacy CDMA carrier/modem infrastructure of the 1990s era, if anywhere; otherwise an anomaly [Unknown]
- Analyst note
- an open port 379 has no plausible modern legitimate use; treat a response as worth investigating rather than routine.
About port 379/udp.
Port 379/udp carries is99c, IANA's registration for the TIA/EIA/IS-99 modem-client protocol — a legacy 1990s CDMA cellular data-call standard — and no evidence of current, active use was found, so an open port 379/udp should not be expected on a modern host and is worth investigating rather than treating as routine.
IANA's Service Name and Transport Protocol Port Number Registry lists port 379 as dual-registered on both TCP and UDP under the name is99c, described only as "TIA/EIA/IS-99 Modem Client." The Assignee, Contact, Registration Date, and Reference columns are all blank in the registry, so no RFC or standards-track document is cited for the assignment.
TIA/EIA/IS-99 was a mid-to-late-1990s U.S. telecom-industry standard defining the data-services (asynchronous data and fax) option for the IS-95 wideband spread-spectrum CDMA digital cellular system, letting a mobile device negotiate a circuit-switched, dial-up-style data call over a CDMA connection, predating IP-based mobile data. The is99c service name maps to the client side of that signaling scheme. No modern software or service was found in port-lookup directories (t1shopper.com, adminsub.net, auditmypc.com, tcp-udp-ports.com) that names a current application commonly generating traffic on this port.
One port-lookup site, auditmypc.com, states without corroboration that a trojan or virus has historically used UDP port 379 for command-and-control, but it names no malware family and cites no date or independent source, so this claim is treated as unverified and is not asserted as fact.
- Unverified threat claim
- a single uncorroborated source describes historical trojan/virus use of UDP port 379 for command-and-control, with no malware name or date given — treated as unverified, not asserted [Unknown] — https://www.auditmypc.com/udp-port-379.asp
- Scanning context
- port 379 does not appear in general UDP-scanning writeups or SANS ISC's port-activity pages as a commonly probed or exploited port; unsolicited traffic is more consistent with broad opportunistic sweeps than a targeted, widely-exploited service[Likely] — https://www.plixer.com/blog/udp-scan-work/, https://isc.sans.edu/services.html
- IANA assignment
is99c— "TIA/EIA/IS-99 Modem Client"; reference (blank in registry); assignee (blank in registry); dual-registered 379/tcp + 379/udp with identical metadata [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (lines 751–752; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 379/udp ≈ 0.000395 — very low (roughly 4 in 10,000 scanned hosts in the nmap-services sample) [Likely] — nmap-services dataset
- Related ports
- none specifically documented in research [Unknown]
Primary use
TIA/EIA/IS-99 modem-client signaling for circuit-switched data calls over CDMA (IS-95) cellular networks, a mid-to-late-1990s telecom standard predating IP mobile data
Other/unofficial uses
none identified; no current, actively-maintained software was found using this port [Unknown]
Security implications
essentially never legitimately open today given the defunct underlying protocol; one uncorroborated report of historical trojan use exists but names no malware and is unverified
Typically seen on
no known current deployment; historically associated only with legacy CDMA-cellular IS-99 client signaling [Unknown]
- Analyst note
- an open port 379/udp is statistically anomalous on a modern network; investigate rather than assume routine service traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| is99c | UDP | TIA/EIA/IS-99 modem client | 0.04% |
| is99c | TCP | TIA/EIA/IS-99 modem client | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.