399
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No confirmed real-world software or service uses port 399; it is an obscure, effectively vestigial IANA registry entry with no vendor documentation or community sightings, so any observed traffic on it should be treated as anomalous and investigated.
- // analyst note
- An open port 399 has no confirmed legitimate use case — investigate as anomalous traffic rather than routine service activity.
- // if you see it open
- No confirmed real-world software or service uses port 399; it is an obscure, effectively vestigial registry entry with no vendor documentation or community sightings. AuditMyPC's port database (checked 2026-08) does not currently flag TCP 399 as associated with any specific virus or trojan, though its generic disclaimer applies to all listed ports. Any observed traffic should be treated as anomalous rather than routine.
About port 399/tcp.
Port 399/tcp is registered with IANA as iso-tsap-c2, "ISO Transport Class 2 Non-Control," but no confirmed real-world application or service uses it; it has no legitimate reason to be reachable from the public internet, and an open port 399 should be treated as anomalous rather than assumed to be routine service traffic.
IANA's registry lists the assignment for both 399/tcp and 399/udp, assignee Yanick Pouffary, with a blank Reference field — meaning no RFC or other document is cited as the protocol's formal definition.
The name points to the OSI transport-layer TSAP (Transport Service Access Point) concept, specifically a Transport Class 2, non-control variant. This is conceptually related to ISO-transport-over-TCP work such as RFC 983, but 399 is a separate, distinct registry entry and should not be confused with the far more common ISO-TSAP port, 102/tcp (RFC 1006/1005), which Siemens S7 industrial PLCs use for S7comm traffic.
No vendor documentation, blog post, forum or support thread, or scanning-tool database attributes any specific client or server software to port 399; generic port-lookup aggregators (SpeedGuide, AuditMyPC, and similar sites) only restate the bare IANA label without naming an application. This appears to be an obscure, effectively vestigial registry entry with no observed community-sourced sightings of real deployment.
- IANA assignment
iso-tsap-c2— "ISO Transport Class 2 Non-Control over TCP/UDP"; reference (blank — no RFC cited); assignee Yanick Pouffary; dual-registered 399/tcp + 399/udp [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=399- Range class
- well-known (0–1023) [Confirmed] — IANA registry
- Prevalence
- 0.000025 (nmap-services open-frequency) [Confirmed] — this site's own tooling
- Related ports
- 102/tcp (ISO-TSAP, RFC 1006/1005; Siemens S7/S7comm) [Confirmed]
Primary use
OSI transport-layer TSAP, Transport Class 2 non-control variant; conceptually related to ISO-transport-over-TCP work (e.g. RFC 983) but a distinct, rarely-implemented entry
Other/unofficial uses
none identified in vendor docs, forums, or scanner databases
Security implications
essentially never seen in legitimate deployment; AuditMyPC currently shows no specific malware association for this port
Typically seen on
no host type identified; treat any sighting as an anomaly to investigate [Unknown]
- Analyst note
- An open port 399 has no confirmed legitimate use case — investigate as anomalous traffic rather than routine service activity.
About port 399/udp.
Port 399/udp carries iso-tsap-c2, the IANA-registered name for "ISO Transport Class 2 Non-Control over UDP"; no legitimate application is documented as using it today, so it should not be exposed to the public internet, and any live responder is worth investigating rather than treating as routine.
The IANA registry lists 399/udp as iso-tsap-c2 with assignee Yanick Pouffary and a blank Reference column — no RFC is cited for this entry, and the registration date field is likewise blank. Port 399/tcp carries the identical service name and assignee, described as "ISO Transport Class 2 Non-Control over TCP," so the pair is dually registered.
The name points to ISO Transport Service Access Point (TSAP) Class 2, non-control variant — part of the OSI transport-layer protocol suite (ISO 8073 / ITU-T X.224 transport classes) adapted to run over IP/UDP rather than native OSI networking. This is a legacy OSI-over-IP interoperability mechanism, conceptually similar to later TPKT/TSAP-over-TCP/IP mappings, and it predates and has been superseded by native TCP/IP transport. Historically it saw limited use in telecom and government/enterprise environments that ran dual OSI/TCP-IP stacks in the 1990s.
No credible sourced sightings of real-world software, malware, or scanning campaigns tied to 399/udp turned up during research. Port-lookup aggregator pages (SpeedGuide, adminsub.net, auditmypc.com) reproduce only the bare IANA registration and report no trojan/virus association for this port; none names a specific vendor product, game client, or P2P application observed using it. Measured scan telemetry (nmap-services, via the repo's canonical port-frequency artifact) shows the port open at a frequency of 0.000395 — a low but non-zero figure consistent with rare legacy-stack survivors rather than any actively-deployed application.
- IANA assignment
iso-tsap-c2— "ISO Transport Class 2 Non-Control over UDP"; reference (blank — no RFC cited); assignee Yanick Pouffary [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 792); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml- Dual registration
- 399/tcp is also registered as
iso-tsap-c2("ISO Transport Class 2 Non-Control over TCP"), same assignee [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 791) - Range class
- well-known (399, within 0–1023 well-known range per IANA and
this site's own tooling) [Confirmed] — this site's own tooling; IANA registry - Prevalence
- 0.000395 open-frequency (nmap-services measured figure) [Confirmed] — this site's own tooling
- Related ports
- 399/tcp (identical registration); other ISO-TSAP-family ports in the same registry block
Primary use
ISO TSAP Class 2 non-control transport, an OSI-over-UDP legacy interoperability mechanism (ISO 8073 / ITU-T X.224 transport classes)
Other/unofficial uses
none documented; no vendor product, game, or P2P client sighting found [Unknown] — https://www.auditmypc.com/udp-port-399.asp; https://www.speedguide.net/port.php?port=399; https://www.adminsub.net/tcp-udp-port-finder/399
Security implications
no known malware/trojan association; essentially never seen legitimately open in modern deployments
Typically seen on
legacy OSI/TCP-IP dual-stack telecom or enterprise gear (historical); otherwise an anomaly [Unknown]
- Analyst note
- registration date is blank in the IANA registry — this is preserved as-is, not fabricated.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| iso-tsap-c2 | UDP | ISO-TSAP Class 2 | 0.04% |
| iso-tsap-c2 | TCP | ISO-TSAP Class 2 | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.