4

Port 4/tcp carries no IANA service assignment: the official IANA Service Name and Transport Protocol Port Number Registry lists it with a blank service name, a Description of "Unassigned," no assignee, and no reference (4/udp is identically blank). It has sat unassigned in the well-known range since the earliest consolidated port lists — it is already absent from the assignment tables in RFC 1340 (July 1992) and has never been claimed since — so there is no protocol, no RFC, and no conventional listener to expect. Because the number is unassigned, any process binding to TCP port 4 does so by private or ad-hoc arrangement only; there is no widely deployed software that uses it by convention, and no specific malware, command-and-control, or threat-intelligence campaign keyed to port 4/tcp surfaced in open sources as of June 2026. The number does, however, appear in Nmap's default top-1000 TCP scan list, which means internet-facing hosts will receive unsolicited probes on it during routine mass scans even though nothing should be listening. For an analyst the practical reading is straightforward: an open port 4/tcp is anomalous on a well-configured host. With no legitimate assigned service to account for it, a responsive port 4 warrants investigation as a misconfiguration, a deliberately obscure private service, a decoy, or a backdoor rather than being dismissed as benign.

IANA assignment

blank service name; Description "Unassigned"; no assignee; reference blank; both 4/tcp and 4/udp listed and unassigned [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)

Range class

well-known (0–1023)

Registration status

the port number row exists in the registry (tcp + udp) but is marked Unassigned — i.e. reserved-as-listed but with no service [Confirmed] — IANA registry CSV

Registration/modification dates

Unknown (the IANA registry carries no date columns for this row) [Unknown]

Related ports

the low unassigned/reserved numbers in the well-known range (e.g. 2, 4, 6); contrast with the assigned small services (7, 9, 13, 17, 19)

Primary use

none — no assigned protocol or service; unassigned since at least RFC 1340 (July 1992) and still unassigned in 2026

Common software

Unknown — no software is associated with port 4/tcp by convention; any binding is private/ad-hoc only

Security implications

appears in the Nmap default top-1000 TCP scan list, so internet-facing hosts will be probed on it; no specific exploit, malware, or C2 association found in open sources as of June 2026; an open state should be treated as anomalous and investigated [Likely] — nmap top-1000 listing (https://nullsec.us/top-1-000-tcp-and-udp-ports-nmap-default/); Nmap port-scanning docs (https://nmap.org/book/port-scanning.html)

Typically seen on

nothing by design — an open port 4/tcp is an anomaly / possible misconfiguration, decoy, or backdoor

Analyst note

There is no assigned service for port 4/tcp, so a responsive port 4 is statistically rare — treat it as anomalous and investigate rather than assuming a benign listener.

Port 4/udp is listed as Unassigned in the IANA Service Name and Transport Protocol Port Number Registry: the registry carries no service name, no description beyond the literal "Unassigned" marker, no assignee, and no RFC or reference for this entry. Its TCP counterpart, port 4/tcp, is identically Unassigned, so the number is unallocated across both transports. Port 4 sits in the System Ports range (0–1023), where any future assignment would require IETF Review or IESG Approval per the registry's procedures — but no such assignment has ever been made. Because the port carries no registered service, there is no protocol behavior to document and no canonical software that binds it. It does not appear among the commonly observed open UDP ports in empirical scanning datasets such as nmap-services, which is consistent with negligible real-world exposure. For an analyst, that absence is itself the signal: traffic seen on UDP port 4 in the wild has no legitimate registered service to explain it, so it is best treated as anomalous — a sign of misconfiguration, non-standard proprietary software, decoy/recon noise, or a host using the low number arbitrarily — rather than as any expected protocol. No CVEs, exploit families, or notable scanning campaigns were tied to UDP port 4 in open sources as of June 2026. The blank IANA reference field is recorded honestly as blank; no RFC, date, or assignee is invented.

IANA assignment

Unassigned — no service name; description "Unassigned"; reference blank (no RFC); no assignee; UDP entry [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 11; https://www.iana.org/assignments/service-names-port-numbers)

Range class

System Ports / well-known (0–1023); assignment would require IETF Review or IESG Approval, none made [Confirmed] — IANA registry procedures (https://www.iana.org/assignments/service-names-port-numbers)

IANA reference

blank (none exists) [Confirmed] — IANA registry

Primary use

none — officially unassigned; no documented primary protocol use

Common software

Unknown — no software is known to register or commonly bind UDP port 4; not listed among commonly observed open UDP ports in nmap-services empirical data

TCP counterpart

port 4/tcp identically Unassigned (dual-unassigned across transports) [Confirmed] — IANA registry CSV line 10

Security / exposure

no CVEs, exploits, or notable scanning campaigns tied to UDP port 4 found in open sources as of June 2026; traffic on this port is anomalous (misconfiguration, proprietary software, or recon noise); negligible real-world exposure surface

[Likely] — https://nmap.org/book/port-scanning.html, https://nmap.org/book/scan-methods-udp-scan.html

Analyst note

An unassigned low-number UDP port with no registered service — investigate any observed traffic as anomalous rather than expected.