400

Port 400/tcp carries Oracle Secure Backup's (OSB) osb-sd service daemon, and it should generally be restricted to trusted backup-administration networks rather than exposed to the public internet.

IANA registers 400/tcp (and 400/udp) as osb-sd, "Oracle Secure Backup," assigned to Steven Wertheimer, with a blank Reference field — no RFC underlies the assignment. The registry entry was registered 2008-06-06 and last modified 2023-12-27, and carries the note "Formerly was Workstation Solutions," indicating the port number previously belonged to an older, now-defunct assignment before Oracle claimed it.

In practice, OSB daemon components on Unix, Linux, and Windows hosts listen on TCP 400 by default within an OSB administrative domain (media servers and clients coordinating backup/restore jobs); NAS-attached OSB hosts instead default to TCP 10000. Oracle's own support documentation on firewall configuration for OSB explicitly covers this default and notes that sessions may additionally negotiate dynamic ports outside 400 during backup/restore operations.

Community port-database sites (e.g., auditmypc.com) still list the port under its legacy name "work-sol"/"Workstation Solutions," a largely defunct assignment predating the 2008 Oracle reassignment; these are secondary compilations rather than confirmed sightings of a distinct active service today. The canonical in-repo dataset this site's own tooling records a measured nmap-services scan frequency of 0.000075 for 400/tcp; a separate, dated Shodan/Censys-style scanning-census figure is confirmed blank across the sources checked (auditmypc.com, IANA registry), not merely unresearched.

IANA assignment

osb-sd — "Oracle Secure Backup"; reference (blank — no RFC cited); assignee Steven Wertheimer; dual-registered 400/tcp + 400/udp; registered 2008-06-06, modified 2023-12-27; assignment notes "Formerly was Workstation Solutions"

[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed]

Prevalence

0.000075 (nmap-services scan frequency) [Confirmed] — this site's own tooling; a dated Shodan/Censys-style scanning-census figure is confirmed blank across the sources checked (auditmypc.com, IANA registry), not merely unresearched [Unknown]

Related ports

10000/tcp (OSB's NAS-host default port) [Likely]

Primary use

Oracle Secure Backup (OSB) service-daemon (osb-sd) communication between OSB daemon components on Unix/Linux/Windows hosts within an OSB administrative domain; NAS-attached OSB hosts default to TCP 10000 instead

Other/unofficial uses

legacy "work-sol"/"Workstation Solutions" name predating the 2008 Oracle reassignment, still seen in community port-database compilations

Security implications

Oracle firewall guidance says OSB hosts should not be broadly exposed, and firewalling should scope which peers reach port 400 plus the dynamic port range used during backup/restore sessions; no documented malware/trojan family associated

Typically seen on

hosts running Oracle Secure Backup administrative-domain components (media servers, clients) [Likely]

Analyst note

An internet-facing 400/tcp is notable primarily as exposure of an Oracle Secure Backup administrative component; Oracle's own guidance favors firewalling to trusted peers rather than open internet reachability.

Port 400/udp is registered with IANA under the service name osb-sd, paired with 400/tcp, and associated with Oracle Secure Backup (OSB); it is not a service meant for the public internet and should stay restricted to trusted backup-network hosts.

The IANA registry lists assignee Steven Wertheimer, a blank Reference column, and dual registration across both TCP and UDP under the same service name. The registry's own notes field states the entry was "Formerly ... Workstation Solutions" (work-sol), an older legacy assignment whose original function is not documented in the sources found. The registry shows a registration date of 2008-06-06 and a last-modified date of 2023-12-27.

Oracle's own support and product documentation confirms Oracle Secure Backup uses TCP port 400 by default for client-server communication among Unix, Linux, and Windows hosts within an OSB domain (NAS hosts instead default to TCP 10000). Oracle's documentation emphasizes the TCP side; no Oracle source found here separately documents an actively used UDP/400 protocol path, so the UDP registration is best treated as the paired IANA assignment rather than a confirmed live service.

That said, nmap-services scan data shows measurable open-port frequency on the UDP side (0.000643, roughly 8.5x the TCP side's 0.000075) — enough real-world traffic to register but still a very low-prevalence port overall, consistent with a niche backup-infrastructure registration rather than a widely deployed service.

No other named applications, P2P clients, or game servers were found using 400/udp in this pass, and no CVE or named malware family is documented against this port. A general port-database site (auditmypc.com) was checked directly for a virus/trojan association and records none for UDP 400 ("Virus / Trojan: No") — matching the paired 400/tcp entry.

IANA assignment

osb-sd — "Oracle Secure Backup"; dual-registered 400/tcp + 400/udp; assignee Steven Wertheimer; Reference column blank [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed]

Registration date

2008-06-06; last modified 2023-12-27 (IANA registry) [Confirmed] — registry

Prevalence

0.000643 (nmap-services open-port frequency), roughly 8.5x the paired 400/tcp figure (0.000075) [Confirmed] — this site's own tooling

Related ports

400/tcp (same service, primary documented path); 10000/tcp (OSB default for NAS hosts) [Likely]

Primary use

Oracle Secure Backup (OSB) client-server communication; Oracle documents TCP 400 as the default port for Unix/Linux/Windows OSB domain members

Security implications

should be restricted to trusted backup-network hosts per Oracle's own firewall guidance; no virus/trojan association is recorded against this port on auditmypc.com ("Virus / Trojan: No"), matching the 400/tcp entry

Typically seen on

Oracle Secure Backup domain members (backup administration servers and clients) [Likely]

Legacy/former name

registry notes "Formerly ... Workstation Solutions" (work-sol); original function undocumented [Confirmed name change / Unknown function]

Analyst note

UDP-specific active use is unconfirmed by Oracle's own documentation, though nmap-services scan data confirms nonzero real-world prevalence; treat 400/udp as the paired IANA registration with modest measured traffic rather than a widely-deployed independent service.