387

Port 387/tcp is registered with IANA as aurp with the description "Appletalk Update-Based Routing Pro." (verbatim, truncated with a trailing period exactly as the registry shows), assignee Chris Ranch, and a blank reference field — RFC 1504 is the defining specification but is not cited in the registry row — dual-registered on TCP and UDP. AURP tunnels AppleTalk between non-contiguous AppleTalk internets across an IP WAN, with update-based routing. RFC 1504 (A. Oppenheimer, Apple Computer, August 1993, Informational) provides wide-area routing enhancements to AppleTalk and is fully compatible with AppleTalk Phase 2: an exterior router encapsulates AppleTalk data packets in UDP packets when forwarding them through its UDP port 387 across an IP tunnel to UDP port 387 on another exterior router, which then decapsulates them. Unlike RTMP, which periodically broadcasts the full routing table, AURP exchanges routing information only when a change occurs and provides reliable, acknowledged delivery of routing updates, saving bandwidth on slow WAN links, and it supports network and device hiding, network-number remapping, clustering, and hop-count reduction. The IANA reference field is blank, and the registry's own description string is truncated. Security-wise AURP is obsolete: AppleTalk and AURP tunneling have essentially no modern footprint, and the protocol's real transport is UDP 387 even though this entry is the TCP registration. For an analyst, an open 387 indicates an obsolete AppleTalk-over-IP router or gateway, and on a current network it is legacy or a misidentification.

IANA assignment

aurp — "Appletalk Update-Based Routing Pro." (verbatim, truncated); reference (blank — RFC 1504 is the defining spec but is NOT cited in the IANA registry row); assignee Chris Ranch; dual-registered 387/tcp + 387/udp (UDP is the operational transport)

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 387/tcp ~0.000000, 387/udp ~0.001285 (de-facto) [Well-established] — nmap-services file

Related ports

AppleTalk RTMP suite (201 at-rtmp, 202 at-nbp, 204 at-echo, 206 at-zis)

Primary use

tunneling AppleTalk over IP WANs with update-based routing — RFC 1504

Other/unofficial uses

none today [Well-established]

Security implications

obsolete AppleTalk tunneling; minimal modern footprint [Well-established]

Typically seen on

legacy AppleTalk-over-IP routers/gateways

Analyst note

An open 387 indicates an obsolete AppleTalk-over-IP router/gateway; on a current network it is legacy or a misidentification.

Port 387/udp carries AURP (AppleTalk Update-Based Routing Protocol), a router-to-router tunneling protocol that encapsulates AppleTalk traffic inside UDP for transport over IP WANs. AppleTalk itself has been obsolete for roughly two decades, so a live AURP endpoint has no legitimate place on the modern public internet; if 387/udp responds today it should be treated as anomalous and investigated rather than assumed to be a stale router artifact.

IANA registers the service name aurp on both 387/tcp and 387/udp, assigned to Chris_Ranch, with the description "Appletalk Update-Based Routing Pro." The registry's Reference column is blank — no RFC number is cited there — even though RFC 1504 (AppleTalk Update-Based Routing Protocol: Enhanced AppleTalk Routing) documents the protocol design in detail.

Functionally, an AURP "exterior router" acts as a tunnel endpoint: it encapsulates AppleTalk data packets inside UDP datagrams addressed to port 387 on a peer exterior router, and the two exchange AppleTalk routing-table update packets to keep path information current across the tunnel. This let separate AppleTalk LANs stay routed over an IP backbone, including, in principle, the public internet as WAN transit between trusted routers.

The nmap-services open-frequency for 387/udp is approximately 0.001285 — small but measurable, and consistent with the already-published 387/tcp entry (which records 387/tcp at ~0.000000 and notes UDP as the de-facto operational transport for AURP). AppleTalk deployments are effectively extinct outside legacy/retrocomputing contexts, so no common applications are listed with confidence. Any traffic seen on 387/udp today is more likely a leftover router configuration, a scan artifact, or unrelated noise than genuine AURP signaling.

IANA assignment

aurp — "Appletalk Update-Based Routing Pro."; reference field blank; assignee Chris_Ranch; dual-registered 387/tcp + 387/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry-768)

Range class

well-known (0–1023) [Confirmed]

IANA reference field

blank — no RFC is formally cited in the registry, despite RFC 1504 documenting the protocol [Confirmed] — IANA registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=387)

Prevalence

nmap-services open-frequency for 387/udp ≈0.001285 [Confirmed] — nmap-services dataset (this site's own tooling)

Related ports

387/tcp (same aurp service, dual-registered) [Confirmed] — IANA registry

Primary use

AURP (AppleTalk Update-Based Routing Protocol) — tunnels AppleTalk traffic over IP WANs between "exterior router" endpoints

Other/unofficial uses

none documented; AppleTalk is legacy/deprecated so contemporary non-AURP traffic on this port is not expected [Unknown]

Security implications

no malware/Trojan association found; auditmypc.com's own verdict line for 387/udp reads "Virus / Trojan: No"

Typically seen on

legacy AppleTalk router deployments (historical); otherwise an anomaly [Likely]

Analyst note

given AppleTalk's obsolescence, an open 387/udp today is statistically unusual and merits investigation as a decoy, leftover legacy configuration, or possible signature match rather than assumed legitimate traffic.