392
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — This is a defunct, vendor-specific 1990s network-management assignment with no documented modern legitimate use, so any live listener today is unexpected and worth investigating.
- // analyst note
- A live 392/tcp or 392/udp listener has no known modern legitimate purpose — treat as anomalous and investigate rather than assume routine traffic.
- // if you see it open
- Essentially never legitimately open today: this is a defunct, vendor-specific 1990s network-management assignment (SynOptics Communications, later Bay Networks/Nortel) with no documented modern legitimate use. No CVE or malware family is credibly attributed to this port. Some low-quality port-database sites carry generic unattributed 'trojan/virus' boilerplate repeated across many unrelated port numbers with no specific family, sample, or date cited — excluded as not credible rather than reported as fact.
About port 392/tcp.
Port 392/tcp carries synotics-broker, IANA's legacy "SynOptics Port Broker Port" service; it has no place on the modern public internet, and a listener today is anomalous rather than an expected finding. The IANA registry confirms the assignment on both TCP and UDP, assignee Illan_Raab, with a blank Reference/RFC field — no protocol specification was ever published for this port.
The name traces to SynOptics Communications, a network-hardware vendor whose "Port Broker" was part of a proprietary, SNMP-era network-management protocol suite from the early 1990s. SynOptics merged with Wellfleet Communications in 1994 to form Bay Networks, which Nortel acquired in 1998; the SynOptics product line and its port-broker service have been discontinued for decades.
No credible, dated evidence of current software using port 392 was found in vendor documentation, blog posts, or forum/support threads, so a modern application attribution would be a guess rather than a finding. Some low-quality "port lookup" sites carry generic, unattributed boilerplate claiming a "trojan or virus" has used many ports including this one; that text repeats across unrelated port numbers with no specific malware family, sample, or date, so it is excluded here as not credible rather than repeated as fact.
- IANA assignment
synotics-broker— "SynOptics Port Broker Port"; Reference column blank; assignee Illan_Raab; dual-registered 392/tcp + 392/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 777-778); IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency for 392/tcp ≈0.000013 [Confirmed] — nmap-services dataset (this site's own tooling)
- Related ports
- none directly related identified in research [Unknown]
Primary use
legacy SynOptics Communications "Port Broker" service, part of SynOptics' proprietary SNMP-era network-management protocol suite; no RFC/reference document [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv, https://en.wikipedia.org/wiki/SynOptics
Other/unofficial uses
none found in vendor docs, blogs, or forums [Unknown]
Security implications
essentially never legitimately open today; defunct vendor-specific assignment; no CVE or malware family credibly attributed; generic unattributed "trojan" boilerplate on low-quality lookup sites excluded as not credible [Likely]
Typically seen on
historically, legacy SynOptics/Bay Networks network-management equipment; otherwise an anomaly if seen today [Likely]
- Analyst note
- A live 392/tcp or 392/udp listener has no known modern legitimate purpose — treat as anomalous and investigate rather than assume routine traffic.
About port 392/udp.
Port 392/udp carries synotics-broker, the SynOptics Port Broker Port; it is a legacy, vendor-specific assignment with no documented contemporary use, so it should not be expected on the public internet and any traffic seen on it warrants investigation rather than trust.
IANA's registry lists 392 as dual-registered on TCP and UDP under the service name synotics-broker, description "SynOptics Port Broker Port," assignee Illan Raab, with a blank Reference field — no RFC formalizes the protocol. SynOptics Communications was a network hub/switch vendor later absorbed into Bay Networks/Nortel; the name strongly implies the port was used for proprietary hub or switch port-management control traffic, though no protocol specification was located to confirm the wire format.
No dated assignment record is published on the IANA page, so a registration date cannot be sourced. No credible evidence of active contemporary software, services, or malware using 392/udp was found. auditmypc.com's own verdict line for this port reads verbatim "Virus / Trojan: No" — a confirmed negative from the site itself, not an inference drawn from a bulk port-range listing.
- IANA assignment
synotics-broker— "SynOptics Port Broker Port"; reference (blank — no RFC cited); assignee Illan Raab; dual-registered 392/tcp + 392/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed] — port number falls in the IANA well-known range
- Prevalence
- nmap-services open-frequency for 392/udp ≈0.000280 [Confirmed] — nmap-services dataset (this site's own tooling)
- Related ports
- no specific related-port cluster identified for this vendor-specific assignment [Unknown]
Primary use
proprietary SynOptics hub/switch port-management/control service (vendor-era registration, no RFC)
Other/unofficial uses
none documented [Unknown]
Security implications
no confirmed CVEs or malware families tied to 392/udp; auditmypc.com's own verdict line for this port reads "Virus / Trojan: No"; essentially never legitimately open today
Typically seen on
legacy SynOptics-era hub/switch management equipment (unconfirmed); otherwise an anomaly [Unknown]
- Analyst note
- an open port 392 is statistically rare and has no confirmed legitimate contemporary role — treat as anomalous and investigate.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| synotics-broker | UDP | SynOptics Port Broker Port | 0.03% |
| synotics-broker | TCP | SynOptics Port Broker Port | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.