39

Port 39/tcp is registered with IANA as rlp with the description "Resource Location Protocol," assignee and contact both [Mike_Accetta], and a blank reference field (dual-registered on TCP and UDP). The protocol itself is defined in RFC 887 (M. Accetta, CMU, December 1983, Experimental): RLP lets an Internet host discover where a particular network service lives — gateways, domain name servers, crash-dump servers, and similar — by broadcasting or unicasting a request that lists the resources it is looking for, and hosts that offer a matching service reply with the resources they can provide. Critically, RFC 887 specifies only UDP port 39 as the transport; the document does not describe a TCP mode at all. The TCP/39 entry exists because IANA, following its usual practice, reserved the same service name on both transports, so the TCP assignment is a parallel registry reservation rather than something RFC 887 ever defined. RLP predates DNS and was designed for the early ARPANET era, so in modern networks it is effectively obsolete — there is no commonly deployed contemporary server or client that uses TCP/39 for legitimate purposes. The IANA reference field is blank (no RFC is cited in the registry), and IANA publishes no registration or modification date for this assignment, so any "date registered" value seen in third-party port databases is a database artifact, not an authoritative record. For an analyst, the port's near-zero legitimate use is the headline: because nothing modern listens here, an unexpected open TCP/39 warrants investigation rather than a benign explanation. Legacy security databases also associate TCP/39 with SubSARI (also catalogued as Backdoor.SubSARI), a Windows 95/98/ME-era backdoor trojan that reportedly used the port as a command-and-control channel; that threat is not considered active today and is documented only in secondary security databases, not a CVE or vendor advisory, so it is reported with lower confidence. The safe default is to block inbound TCP/39 at the perimeter and treat any responsive listener as suspicious.

IANA assignment

rlp — "Resource Location Protocol"; reference (blank — no RFC cited in IANA registry); assignee and contact both [Mike_Accetta]; dual-registered 39/tcp + 39/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)

Range class

well-known (0–1023) [Confirmed]

Registration / modification date

Unknown — IANA publishes no registration or modification date for this assignment; both columns are blank. Third-party "date registered" values are database artifacts, not authoritative IANA records [Confirmed] — IANA registry; RFC 887 (December 1983) is the protocol spec date only

Related ports

39/udp (the transport RFC 887 actually specifies); contrast DNS (53), which superseded ARPANET-era resource discovery

Primary use

resource-discovery protocol — a host requests the location of network services (gateways, name servers, crash-dump servers) and matching hosts reply; RFC 887 defines only the UDP transport

Protocol status / RFC

RFC 887 (Accetta, CMU, December 1983), Experimental; no security considerations section present in the document; the TCP/39 assignment is a parallel IANA reservation, not described by RFC 887

Common software

none in wide modern use — RLP predates DNS and is effectively obsolete; no contemporary server or client implementation is commonly deployed

Security implications

near-zero legitimate traffic, so an unexpected open TCP/39 is unlikely to be benign and should be investigated; standard hardening guidance is to block unused legacy well-known ports; no recent (2024–2025) mass-scanning campaigns specifically targeting 39/tcp were found in available sources [Likely] — auditmypc.com (https://www.auditmypc.com/tcp-port-39.asp), InventiveHQ firewall-blocking guidance (https://inventivehq.com/blog/which-ports-should-i-block-on-my-firewall)

Malware associations

SubSARI / Backdoor.SubSARI — a Windows 95/98/ME-era backdoor trojan historically reported to use TCP/39 as a C2 channel; documented only in legacy security databases, not a CVE or vendor advisory; not considered active today [Likely] — auditmypc.com (https://www.auditmypc.com/tcp-port-39.asp), adminsub.net (https://www.adminsub.net/tcp-udp-port-finder/subsari)

Typically seen on

nothing modern by design; a responsive listener is an anomaly / possible backdoor or decoy

Analyst note

An open TCP/39 is statistically rare and has no modern legitimate use — treat it as suspicious, investigate the listener, and block inbound at the perimeter by default.

Port 39/udp is registered with IANA as rlp with the description "Resource Location Protocol," assignee [Mike_Accetta], and a blank reference field (dual-registered on TCP and UDP under the same service name, description, and assignee). The protocol is defined in RFC 887 (M. Accetta, Carnegie-Mellon University, December 1983): an early UDP request-reply mechanism that lets an Internet host discover which systems on a directly-connected network provide a particular service or gateway. A host broadcasts a query and any host offering the resource replies, using four message types — Who-Provides?, Do-You-Provide?, Who-Anywhere-Provides?, and Does-Anyone-Provide?. The idea predates the widespread deployment of DNS and has not been updated since 1983; the IETF classifies RFC 887 as Legacy with no formal standing in the standards process. The IANA reference field is blank — no RFC is cited in the registry row, and that blank is preserved here rather than fabricated. For an analyst, RLP is effectively obsolete: modern service discovery is handled by DNS-SD, mDNS/Bonjour, and SLP, and the RLP use case has been entirely superseded. The port remains formally assigned but sees negligible real-world use, so any inbound UDP/39 traffic from the public internet is anomalous. Because port 39 falls in the System Ports range (0–1023) and the underlying protocol is dead, standard firewall practice — blocking all inbound traffic on unused well-known ports — applies directly. No notable scanning campaigns, CVEs, DDoS amplification/reflection abuse, or malware associations specific to UDP/39 were found in public sources as of June 2026; auditmypc.com explicitly lists no virus or trojan association for this port. No actively-maintained software is known to use it. A responsive UDP/39 today is statistically rare and worth investigating as a misconfiguration, a decoy, or anomalous traffic rather than a normal service.

IANA assignment

rlp — "Resource Location Protocol"; reference (blank — no RFC cited in IANA registry); assignee [Mike_Accetta]; dual-registered 39/tcp + 39/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers)

Range class

well-known / System Ports (0–1023) [Confirmed] — IANA registry

Registration date

Unknown — IANA registry row leaves Registration Date and Modification Date blank; no citable third-party date found (not attributed to IEEE, which publishes none) [Unknown]

Related ports

39/tcp (identical rlp registration); contrast modern service-discovery protocols

Primary use

broadcast-based resource/service discovery (RFC 887; rarely deployed, predates DNS)

Protocol mechanics

UDP request-reply; four message types — Who-Provides?, Do-You-Provide?, Who-Anywhere-Provides?, Does-Anyone-Provide?

Other/unofficial uses

Unknown — no current actively-maintained software known to use this port; modern equivalents (DNS-SD, mDNS/Bonjour, SLP) replaced the RLP use case [Unknown]

Security implications

no documented scanning campaigns, CVEs, DDoS amplification/reflection abuse, or active exploitation targeting UDP/39 in public sources (as of June 2026); inbound traffic on this obsolete well-known port is anomalous and should be blocked by default firewall policy

Malware associations

none confirmed; auditmypc.com flags no current virus or trojan association for UDP/39

Current relevance

effectively obsolete; RFC 887 is IETF Legacy with no formal standing, unchanged since 1983 [Confirmed] — RFC 887, IANA registry

Analyst note

An open UDP/39 is statistically rare and the protocol is dead — treat as a misconfiguration, decoy, or anomaly and investigate; legitimate use is unlikely.