391

Port 391/tcp carries synotics-relay, IANA's registration for the "SynOptics SNMP Relay Port," and it belongs on internal network-management infrastructure rather than the public internet. The assignment is dual-registered on TCP and UDP under the same service name and description, with no RFC reference, no listed assignee, and no recorded registration date in the IANA registry.

The service traces to SynOptics Communications, a networking vendor whose product line relayed SNMP traffic between managed devices and a management station. SynOptics merged with Wellfleet Communications in 1994 to form Bay Networks, which Nortel then acquired in 1998, so the vendor lineage behind this port has been effectively defunct for over two decades.

Beyond the IANA entry itself, independent evidence of software actively using port 391 today is thin. One low-quality port-database aggregator additionally claims the port is used for Linux Kernel Crash Dump (LKCD), but this could not be corroborated against a primary LKCD source or a second independent source, so it is treated as unverified rather than folded into the confirmed record.

No documented CVEs, malware, or scanning campaigns specific to port 391 were found [Confirmed — absence checked]. That is an absence-of-evidence finding rather than a confirmed absence of risk — a legacy, single-vendor port like this is rarely exercised, so a live listener today is either a very old management deployment or worth flagging as anomalous.

IANA assignment

synotics-relay — "SynOptics SNMP Relay Port"; reference blank (no RFC cited); assignee not listed; dual-registered 391/tcp + 391/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed] — port number falls in the IANA well-known range

Prevalence

nmap-services open-frequency for 391/tcp ≈0.000013 [Confirmed] — nmap-services dataset (this site's own tooling)

Related ports

161/udp and 162/udp (SNMP), the broader network-management context this relay served; 391/udp (dual registration of the same service name) [Confirmed] — IANA registry

Primary use

legacy SynOptics Communications (later Bay Networks/Nortel) SNMP relay function for network device management; no RFC underlies the assignment [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml, https://en.wikipedia.org/wiki/SynOptics

Other/unofficial uses

a single low-quality aggregator claims Linux Kernel Crash Dump (LKCD) usage; uncorroborated by a primary or second independent source

Security implications

no documented CVE, malware, or scanning campaign specific to port 391; vendor lineage defunct since 1998, so a live listener is either a very old management deployment or an anomaly

Typically seen on

legacy SynOptics/Bay Networks network management deployments (largely historical); otherwise an anomaly on modern networks

Analyst note

an open port 391 today is statistically rare and tied to a defunct vendor lineage; treat as a legacy-management artifact or an anomaly worth investigating rather than assume routine benign use.

Port 391/udp carries synotics-relay, IANA's SynOptics SNMP Relay Port; it is a legacy network-management channel that should stay restricted to internal, trusted network segments rather than be exposed to the public internet.

The registration traces to SynOptics Communications, Inc., a Santa Clara network-equipment vendor known for pioneering the modular Ethernet hub. SynOptics used the port as an SNMP relay/proxy within its network-management software, forwarding SNMP messages between managed devices and management stations. SynOptics merged with Wellfleet Communications in 1994 to form Bay Networks, which Nortel acquired in 1998, leaving the underlying product line effectively defunct. The IANA entry is dual-registered on both 391/tcp and 391/udp, with the Reference column left blank — no RFC documents the protocol.

No credible reports of other software using UDP 391 turned up. A security-vendor signature page lists a SYNOTICS-RELAY signature tied to this port, but its own listed port set looks mismatched with an unrelated group of ports, and a low-quality port database's claim that 391 serves a "Time Synchronization Protocol" contradicts the IANA registry and could not be corroborated elsewhere — both are disregarded as unreliable rather than treated as fact.

IANA assignment

synotics-relay — "SynOptics SNMP Relay Port"; reference (blank — no RFC cited); assignee (blank); dual-registered 391/tcp + 391/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency for 391/udp ≈0.000988 [Confirmed] — nmap-services dataset (this site's own tooling)

Related ports

SNMP 161/162; other legacy 1990s network-management ports

Primary use

SNMP relay/proxy channel used by SynOptics Communications' network-management software, relaying SNMP traffic between managed devices and management stations

Other/unofficial uses

none credible found; a vendor signature page and a low-quality port database both surfaced unreliable/mismatched claims and are disregarded [Unknown]

Security implications

no CVEs or named malware documented; no malware/C2 association is recorded — auditmypc.com's own verdict line for 391/udp reads "Virus / Trojan: No"; no honeypot/threat-intel scanning reports

Typically seen on

legacy SynOptics/Bay Networks network-management hosts; otherwise an anomaly or generic scan noise

Original registrant

SynOptics Communications, Inc., merged with Wellfleet Communications in 1994 to form Bay Networks, which Nortel acquired in 1998 [Likely] — https://en.wikipedia.org/wiki/SynOptics

Analyst note

Traffic on 391/udp today is far more likely background port-scanning noise than genuine SynOptics protocol activity, given the vendor's product line has been defunct since the 1994 Bay Networks merger and the subsequent 1998 Nortel acquisition.