384

Port 384/tcp is registered with IANA as arns with the description "A Remote Network Server System," assignee David Hornsby, and a blank reference field (dual-registered on TCP and UDP). Its purpose is obscure, with little authoritative public documentation beyond the IANA registry string itself. Beyond the registry entry and mirrored port lists, there is no substantive public protocol specification, RFC, or vendor documentation for ARNS, and secondary port-database descriptions that elaborate on its function appear to be generic or inferred rather than authoritative and should not be treated as reliable. The IANA reference field is blank. Security-wise the port has a negligible documented footprint; a sighting on 384 is more likely a misidentification, or an unrelated service squatting on the number, than a genuine ARNS deployment. For an analyst, an open 384 is most likely misidentified and should be verified with service or version detection rather than by trusting the port label. This entry is marked at medium overall confidence specifically because the protocol's substance is undocumented; the IANA registration fields themselves (service name, description, assignee, blank reference) are high-confidence, but no reliable description of what ARNS actually does could be established.

IANA assignment

arns — "A Remote Network Server System"; reference (blank — no RFC cited in IANA registry); assignee David Hornsby; dual-registered 384/tcp + 384/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low; not prominent in nmap-services (de-facto) [Well-established] — nmap-services file

Related ports

none meaningful

Primary use

obscure/undocumented beyond the registry string [Unverified]

Other/unofficial uses

none documented [Unverified]

Security implications

negligible documented footprint; a sighting is more likely a misidentification than genuine ARNS [Well-established]

Typically seen on

unclear; effectively never seen as genuine ARNS

Analyst note

An open 384 is most likely misidentified; verify with service/version detection rather than trusting the port label.

Port 384/udp is registered with IANA as arns, described only as "A Remote Network Server System"; no protocol specification, reference RFC, or corroborated software sighting supports any legitimate use today, so a live listener here should be treated as unexplained rather than assumed benign.

The IANA Service Name and Transport Protocol Port Number Registry lists 384 as arns on both tcp and udp under an identical service-name and description entry, assignee David Hornsby. The Reference column is blank — IANA cites no RFC or standards document for this registration, and none should be invented; the entry reads as a name-and-description-only assignment from the early user-port era.

No working protocol description, reference implementation, or independently verifiable report of software generating traffic on 384/udp turned up in this research pass. Several low-quality port-lookup aggregator sites (SpeedGuide, auditmypc.com, whatportis.com) merely restate the IANA arns label rather than document actual usage, so they are not treated as sightings.

IANA assignment

arns — "A Remote Network Server System"; reference (blank — no RFC cited in registry); assignee David Hornsby; dual-registered 384/tcp + 384/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed]

Prevalence

no nmap-services open-frequency figure available for this research pass [Unknown]

Related ports

384/tcp (identical dual IANA registration, same service name and description) [Confirmed] — IANA registry

Primary use

no confirmed protocol or specification; appears to be a legacy user-port-era placeholder registration named arns

Other/unofficial uses

none confirmed; aggregator sites merely restate the IANA label rather than document real deployments [Unknown]

Security implications

no CVE or confirmed malware association found; one uncorroborated aggregator claim of past trojan flagging

Typically seen on

no confirmed hosts or software; a responsive listener is an anomaly [Unknown]

Analyst note

Treat an open 384/udp as unexplained — no legitimate documented service justifies its appearance on a production host; investigate rather than assume benign use.