38
Summary
- // if you see it open
- Low risk in practice. RAP is an undeployed experimental protocol (RFC 1476, June 1993, Experimental) with no known exploits, no CVE records, and no active scanning campaigns documented across available sources (Shodan exposure dashboard, SpeedGuide, security blogs as of June 2026). Port 38 does not appear on common high-risk-port lists. Real-world exposure is expected to be negligible; a responsive listener is more likely a misconfiguration, decoy, or unrelated service than genuine RAP. Generic risk from any unexpectedly open well-known port still applies. (SpeedGuide port 38 page returned HTTP 403; absence of threat data corroborated across multiple searches.)
- // analyst note
- An open port 38 is not an expected RAP deployment — treat it as an anomaly and investigate the actual listener rather than assuming Route Access Protocol.
About port 38/tcp.
Port 38/tcp is registered with IANA as rap with the description "Route Access Protocol," assignee Robert Ullmann, and blank Registration Date, Modification Date, and Reference fields (dual-registered on TCP and UDP with the same assignee). The protocol is defined in RFC 1476 (R. Ullmann, Process Software Corporation, June 1993, Experimental status): RAP was an experimental distance-vector routing protocol meant to distribute routing information at every scale of the internet, from an isolated LAN to a large carrier network. The two transports split the work — TCP port 38 carries peer sessions (two routers open a symmetric, full-duplex connection, simultaneously exchange their entire route tables, then send only incremental updates and purge commands), while UDP port 38 carries peer discovery (non-routing hosts listen for local gateway advertisements). RAP was tied to the IPv7 addressing model of RFC 1475 and ran over IPv4 networks, but neither the protocol nor IPv7 ever moved past Experimental status; both remain 1993 historical artifacts. No subsequent RFC formally obsoletes RFC 1476, and no standards-track successor exists — in practice the unified intra- and inter-domain routing RAP aimed at was instead served by OSPF and BGP. For an analyst the practical takeaway is that RAP was never deployed in any known production router OS or software package, so real-world exposure on the public internet is expected to be negligible. No CVE records, threat-intelligence reports, or notable scanning campaigns targeting port 38/tcp were found across available sources (Shodan exposure dashboard, SpeedGuide, security blogs as of June 2026), and the port does not appear on common high-risk-port lists. A responsive port 38/tcp on a public-facing host is therefore far more likely to be a misconfiguration, a decoy, or an unrelated service than a genuine RAP listener.
- IANA assignment
rap— "Route Access Protocol"; reference (blank — no RFC cited in IANA registry); assignee Robert Ullmann; dual-registered 38/tcp + 38/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services observed open-frequency 38/tcp ≈ 0.000025 (very low — roughly 2 to 3 in 100,000 scanned hosts in the nmap-services sample); the paired 38/udp row is about eighty times higher at ≈ 0.002043, which reflects UDP-scan ambiguity (no-response counted as open|filtered) and mass UDP sweeps rather than RAP peer discovery in service [Confirmed] — nmap-services dataset. The TCP figure records scan-observed openness on the port number, not a genuine RAP session listener, and at that magnitude it corroborates the never-deployed reading [Confirmed]
- Related ports
- 38/udp (RAP peer discovery, same assignee); contrast modern routing-control ports such as 179/tcp (BGP) and 89 (OSPF)
Primary use
RAP peer-to-peer TCP session for routing-table exchange between routers — symmetric full-duplex connection, full table exchange then incremental updates and purges (RFC 1476; experimental, never deployed)
Other/unofficial uses
none known; the protocol stayed academic and shipped in no widely distributed router OS
Security implications
Low risk in practice — RAP is an undeployed experimental protocol with no known exploits, CVE records, or active scanning campaigns; generic risk from any unexpectedly open well-known port still applies [Likely/Threat-reported] — Shodan exposure dashboard, SpeedGuide (SpeedGuide port 38 page returned HTTP 403; absence of threat data corroborated across multiple searches)
Typically seen on
nothing in normal operation; a responsive listener is likely a misconfiguration, decoy, or unrelated service
- Analyst note
- An open port 38 is not an expected RAP deployment — treat it as an anomaly and investigate the actual listener rather than assuming Route Access Protocol.
About port 38/udp.
Port 38/udp is registered with IANA as rap with the description "Route Access Protocol," assignee Robert Ullmann, and a blank reference field. The protocol is defined in RFC 1476 (R. Ullmann, Process Software Corporation, June 1993; Experimental, and never advanced to the Standards Track), which describes RAP as a distance-vector routing protocol meant to distribute routing information at every scale of the internet, from an isolated LAN up to large inter-domain networks; the same experimental-era document references the IPv7 addressing work of RFC 1475. The transport split is purposeful in the RFC's design: UDP port 38 is used for peer and gateway discovery — non-routing hosts may listen for RAP datagrams to find local gateways, and routers broadcast availability or poll for candidate peers at startup — while TCP port 38 carries the sustained peer-to-peer route exchanges between routers. RAP's security model is cooperative rather than cryptographic (acceptable-use-policy tagging and source/destination filters, with no authentication or integrity guarantees), which is unremarkable for its era. The protocol never achieved broad adoption; no major router vendor, OS networking stack, or current software package is documented as implementing it, and it was eclipsed by OSPF, BGP, and the RIP family. The IANA reference field is blank, and IANA publishes no registration date for this entry, so none is asserted here. For an analyst the practical reading is obsolescence: legitimate RAP traffic is effectively absent from modern networks, no CVEs or active malware families are documented as specifically targeting 38/udp, and one secondary source notes the port has historically appeared in trojan/malware port lists (uncorroborated by CVE or ISC data). Any traffic seen on 38/udp today is anomalous and worth investigating rather than a normal service.
- IANA assignment
rap— "Route Access Protocol"; reference (blank — no RFC cited in IANA registry); assignee Robert Ullmann; governing protocol RFC 1476 (Experimental), not the IANA-cited reference [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 38/udp ≈ 0.002043 — very low (roughly 2 in 1,000 sampled hosts), 189th of 5,615 UDP entries; the TCP sibling 38/tcp is ≈ 0.000025, about 80× lower. The figure records how often the port answers a scan, not RAP use — no source identifies what is listening[Likely] — nmap-services dataset. No Shodan/Censys exposure figure for 38/udp was obtained in this pass [Unknown]
- Related ports
- 38/tcp (RAP route exchange — dual-registration unconfirmed); modern routing siblings 520/udp (RIP), 179 (BGP), OSPF (IP proto 89)
Primary use
RAP peer/gateway discovery over UDP — hosts listen for RAP datagrams to find local gateways; routers broadcast availability or poll for peers at startup (RFC 1476)
Other/unofficial uses
none documented; no widely deployed software is known to implement RAP
Security implications
cooperative (non-cryptographic) security model — no authentication or integrity; no CVEs or active malware specifically documented for 38/udp; one secondary source notes historical appearance on trojan/malware port lists (uncorroborated); attack surface negligible because the protocol is essentially unused
Typically seen on
effectively never seen in modern environments; an open or active 38/udp is anomalous
- TCP dual-registration
- Unknown — only the 38/udp row was checked in the registry pass; RFC 1476 describes TCP 38 carrying sustained router-to-router route exchange, but the IANA 38/tcp row was not independently confirmed [Unknown]
- Analyst note
- RAP is an obsolete Experimental protocol; treat any 38/udp traffic as anomalous and investigate as a possible scan artifact, decoy, or legacy cruft rather than a normal service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| rap | UDP | Route Access Protocol | 0.20% |
| rap | TCP | Route Access Protocol | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.