401

Port 401/tcp is registered with IANA as ups with the description "Uninterruptible Power Supply," assignee and contact Charles Bennett, a registration date of 2008-08-29, and a blank reference field (dual-registered on TCP and UDP). It is intended for network monitoring and management of uninterruptible power supplies — status, battery state, and shutdown signaling. There is, however, no published protocol specification tied to this registration: a 2021 IETF Internet-Draft from the Network UPS Tools (NUT) project notes that since the 2008 assignment of ups/401 to Charles Bennett, no protocol document or published activity report for this port has been found other than one Windows trojan, and the project has petitioned IANA to re-assign the port. The dominant real-world UPS-management ecosystems are separate from this registration: NUT (Network UPS Tools) uses TCP 3493 (service name nut), and APC PowerChute and SNMP-based UPS monitoring per RFC 1628 (the UPS MIB, May 1994) use SNMP on 161. The IANA reference field is blank. Security-wise the port is minor and low-prevalence; an exposed UPS-management interface could in principle let an attacker signal shutdown of powered equipment, a denial of service against whatever the UPS feeds, and the NUT draft flags both the historical Windows-trojan association and that sub-1024 system ports attract more malicious scanning. For an analyst, an open 401 is rare and usually benign, but because no real standardized protocol uses it, unexplained 401 traffic warrants a closer look.

IANA assignment

ups — "Uninterruptible Power Supply"; reference (blank — no RFC cited in IANA registry); assignee Charles Bennett; registration date 2008-08-29; dual-registered 401/tcp + 401/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

very low; nmap-services open-frequency ~0.000025 (de-facto) [Well-established] — nmap-services file

Related ports

3493 (nut — Network UPS Tools), SNMP/161 (RFC 1628 UPS MIB), APC PowerChute

Primary use

network monitoring/management of UPS devices (intended); no published protocol spec

Other/unofficial uses

distinct from NUT (3493) and SNMP UPS MIB (RFC 1628) ecosystems [Well-established]

Security implications

minor; an exposed UPS management interface could allow shutdown/DoS of powered equipment; documented historical Windows-trojan association [Well-established/Threat-reported]

Typically seen on

UPS management interfaces (where seen at all)

Analyst note

An open 401 is rare and usually benign, but since no real standardized protocol uses it, unexplained 401 traffic warrants a closer look.

Port 401/udp carries no confirmed, currently-documented protocol or software; the IANA-registered name ups (Uninterruptible Power Supply) has no active legitimate implementation on record, so a response on this port should be treated as anomalous rather than expected, whether seen from the public internet or an internal network.

The IANA registry lists 401 as dual-registered on both TCP and UDP under the service name ups ("Uninterruptible Power Supply"), assigned 2008-08-29 to contact Charles Bennett. The Reference column is blank — no RFC ever documented the protocol, so that field stays empty rather than invented.

A first-party 2026 message from the Network UPS Tools (NUT) project to IANA states the project "has been unable to find any protocol document or other published activity report for this port other than the One Windows Trojan" reference. The registration itself is dormant and unmaintained, with no protocol document or activity report on file. NUT is now proposing to repurpose 401/tcp for TLS-secured UPS traffic while keeping legacy use on 3493/tcp; the request does not separately address 401/udp.

Older secondhand "trojan port" catalogs (not primary vendor sources) list port 401 against an unnamed Windows trojan, but no source found in this pass names a specific malware family, so that association is noted only as a dated, low-confidence catalog entry.

Measured scan telemetry (nmap-services open-frequency data) puts 401/udp at 0.00056 — a rare but non-zero response rate, consistent with a legacy/dormant registration rather than an actively deployed service.

IANA assignment

ups — "Uninterruptible Power Supply"; reference (blank); assignee [Charles_Bennett]; dual-registered 401/tcp + 401/udp, registered 2008-08-29 [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 796

Range class

registered (1024 and above is typical, but 401 falls in the well-known 0–1023 range) — well-known [Confirmed] — IANA registry

Prevalence

measured nmap-services open-frequency for 401/udp is 0.00056 [Confirmed] — this site's own tooling

Related ports

3493/tcp (NUT's actual legacy UPS network protocol port); the small-services/legacy cluster

Primary use

nominally network-attached UPS status/management per the IANA name, but no documented protocol or current legitimate deployment was found

Other/unofficial uses

legacy /etc/services entries inherited from the IANA name; NUT project is proposing future TLS-secured use of 401/tcp (not udp specifically)

Security implications

dormant, unmaintained registration with no legitimate documented use; secondhand catalogs (uncorroborated) associate the port with an unnamed Windows trojan [Likely/Threat-reported] — https://www.mail-archive.com/nut-upsuser@alioth-lists.debian.net/msg01630.html, http://www.chebucto.ns.ca/~rakerman/trojan-port-table.html

Typically seen on

essentially nowhere in current legitimate deployments; an anomaly if observed, consistent with the measured 0.00056 open-frequency

Analyst note

An open 401/udp is not tied to any confirmed current legitimate service — investigate rather than assume routine UPS traffic.