402

Port 402/tcp is registered with IANA under the service name genie ("Genie Protocol"), but no RFC defines a wire format for it, and the port's real-world traffic is generally attributed instead to Symantec/Broadcom Altiris Deployment Solution's discovery agents; it is not designed for public exposure and should be restricted to internal management networks.

IANA lists genie as dual-registered on TCP and UDP port 402, with Mark Hankin as the assignee/contact and a blank Reference field — the assignment traces to the RFC 1700-era Assigned Numbers list, but RFC 1700 itself is a numbers compilation, not a specification, so no protocol document should be cited for genie.

Community and vendor-adjacent sources instead associate 402/tcp with Altiris Deployment Solution's AClient and BootWorks client agents, which use the port to discover or announce to a Deployment Server, and with RapiDeploy multicast imaging, where 401-402 formed the default multicast port range documented in a December 2002 HPE-hosted Altiris technical note. This usage predates Symantec's 2007 acquisition of Altiris.

The port sees little general internet background-scan traffic, unlike common internet-facing services, because it is a legacy enterprise-internal deployment protocol rather than a public one. Where 402 is legitimately open, the exposure concern is internal-network risk — unencrypted deployment traffic per one secondary source — rather than internet-facing abuse.

IANA assignment

genie — "Genie Protocol"; reference (blank — no RFC cited); assignee Mark Hankin; dual-registered 402/tcp + 402/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed]

IANA-defined protocol

no RFC formally documents the genie protocol; the entry traces through the RFC 1700-era Assigned Numbers list, which is a numbers compilation rather than a spec [Confirmed] — RFC 1700

Prevalence

0.000038 (nmap-services open-frequency) [Confirmed] — this site's own tooling

Related ports

401/tcp (paired with 402 in Altiris's default multicast imaging range) [Likely] — HPE Altiris document

Security implications

not a commonly internet-scanned port; Altiris deployment traffic reported unencrypted by default per one secondary, non-primary source

Typically seen on

enterprise networks running Altiris Deployment Solution for OS imaging/deployment; otherwise anomalous [Likely]

Malware association

unverified community trojan-port-list entry ("One", Windows); no primary AV-vendor source found

Real-world primary use

Symantec/Broadcom Altiris Deployment Solution client-discovery (AClient, BootWorks) and RapiDeploy multicast imaging (401–402 default range) [Likely] — whatportis.com, HPE-hosted Altiris technical document (Dec 2002), Cisco community

Port 402/udp is IANA-registered as genie ("Genie Protocol"), but no RFC or vendor specification documents what the protocol actually does; the one confirmed real-world use of the port — legacy Altiris client multicast discovery — is an internal systems-management mechanism, so genuine traffic here should stay internal-only rather than face the public internet.

IANA's Service Name and Transport Protocol Port Number Registry lists 402 as dual-registered on both TCP and UDP, with assignee [Mark_Hankin] and a blank Reference column (the column holds a contact name, not a citable RFC). No protocol specification has been published under this registration.

The one concrete sighting in community sources is a 2003 report on the SANS Internet Storm Center describing Altiris — systems-management and imaging client software — using UDP/402 to send a multicast discovery packet to 225.1.2.3 roughly once per minute. That behavior is host/network discovery for internal IT-management tooling, not a service meant to answer external requests.

Beyond that, SANS ISC's live port tracker shows only sporadic, low-volume background scanning on 402/udp (single-digit to low-hundreds of hits per source IP), consistent with generic internet-wide probing rather than targeted exploitation. No CVEs are associated with the port, and SANS ISC's threat-level indicator for it is green.

IANA assignment

genie — "Genie Protocol"; reference column blank (holds contact name [Mark_Hankin], not an RFC); dual-registered 402/tcp + 402/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry lines 797-798

Range class

well-known (0–1023) [Confirmed]

Prevalence

0.00173 (nmap-services open-frequency) [Confirmed] — this site's own tooling; SANS ISC's live tracker separately shows sporadic, low-volume background scanning (single-digit to low-hundreds of hits per source IP) [Likely] — https://isc.sans.edu/data/port/402

Related ports

none specifically documented in reviewed sources [Unknown]

Primary use

registered name only — no RFC or vendor specification describes the protocol's actual semantics

Other/unofficial uses

Altiris systems-management/imaging client multicast discovery, reportedly probing 225.1.2.3 roughly once per minute

Security implications

no CVEs identified; SANS ISC threat-level indicator is green (low concern); no legitimate case for public exposure given the internal-discovery use case

Typically seen on

legacy Windows endpoints running Altiris client software; otherwise background internet scan traffic

Analyst note

Treat 402/udp as an internal systems-management discovery port; an internet-facing responder is anomalous rather than expected, though not tied to any known exploit.