409
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — Prospero is a defunct 1990s research system with no documented modern use, so a legitimately open port 409 would not be expected on any host, internal or internet-facing.
- // analyst note
- An open port 409 is essentially unheard of today; treat as anomalous and investigate rather than assume legitimate Prospero use.
- // if you see it open
- No CVE, malware family, or backdoor documented for this port. auditmypc.com explicitly marks TCP 409 as not associated with any virus or trojan. A SANS-linked port database (internet-security.com) has no entry for it at all, consistent with negligible modern scanning or usage interest. Prospero itself is defunct, so any observed traffic on 409/tcp is unexpected and should be investigated as anomalous.
About port 409/tcp.
Port 409/tcp is registered to prm-nm, the node-manager component of Prospero, an experimental early-1990s distributed resource-management system; no modern software, malware, or legitimate service is documented on it, so an open port 409 has no expected use on any host, internal or internet-facing.
The IANA registry lists the service name as prm-nm with description "Prospero Resource Manager Node Man." — truncated in the registry, almost certainly "Node Manager" — assigned to B. Clifford Neuman, with a blank Reference field: no RFC was ever published for this assignment. Both 409/tcp and 409/udp are registered under the same name.
Prospero itself was a distributed file/resource-management system built by Neuman at USC/ISI in the early 1990s, predating and influencing later work like AFS-style distributed filesystems. It saw limited academic deployment and has been effectively obsolete for decades; no active clients or servers were found in this research pass.
No CVE, malware family, or backdoor has been tied to this port. A secondary port-database site (auditmypc.com) explicitly marks TCP 409 as not associated with any virus or trojan, and another (internet-security.com) carries no data on it at all — consistent with a port that sees essentially no traffic or scanning interest today.
- IANA assignment
prm-nm— "Prospero Resource Manager Node Man[ager]"; reference (blank — no RFC cited); assignee B. Clifford Neuman; dual-registered 409/tcp + 409/udp [Confirmed] — IANA service-names-port-numbers registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 409/tcp ~0.000000 (not observed open in scan corpus) [Confirmed] — this site's own tooling
- Related ports
- other Prospero-family assignments (e.g. 191/tcp
prospero); contrast modern distributed-filesystem ports
Primary use
node-manager component of Prospero, an experimental distributed resource-management system (USC/ISI, early 1990s); no modern/active use identified
Other/unofficial uses
none found
Security implications
no CVE, malware, or trojan association documented; explicitly cleared by auditmypc.com
Typically seen on
nothing currently; historically, legacy Prospero deployments only [Unknown]
- Analyst note
- An open port 409 is essentially unheard of today; treat as anomalous and investigate rather than assume legitimate Prospero use.
About port 409/udp.
Port 409/udp is registered with IANA as prm-nm, the Node Manager component of the Prospero Resource Manager; it is a dormant early-1990s research protocol with no documented modern deployment, so it should not be expected on the public internet and should not be treated as legitimate if seen open.
IANA lists the assignment (dual-registered as 409/tcp with identical properties) with the description "Prospero Resource Manager Node Man." and assignee B. Clifford Neuman; the Reference field is blank, meaning no RFC is cited for this specific port assignment.
Prospero was a distributed file/resource-location system built at USC/ISI in the early 1990s. Port 409 covered the Node Manager piece of that system, distinct from the base Prospero directory service registered at port 191. It saw academic use but never reached mainstream production deployment.
No credible, sourced sightings of any current software actively using udp/409 were found across the IANA registry, SpeedGuide, AuditMyPC, or general web search. The port appears effectively silent in present-day internet traffic outside of legacy or anomalous contexts.
- IANA assignment
prm-nm— "Prospero Resource Manager Node Man."; reference (blank); assignee B. Clifford Neuman [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 409/udp ~0.000461 [Confirmed] — this site's own tooling
- Related ports
- 409/tcp (dual registration, identical prm-nm assignment); 191/udp,tcp (base Prospero directory service)
Primary use
Prospero Resource Manager Node Manager; legacy research protocol from the Prospero distributed system (USC/ISI, early 1990s)
Other/unofficial uses
none found in this research pass [Unknown]
Security implications
no CVE or actively-tracked malware family documented; none documented — auditmypc.com's own verdict line for 409/udp reads "Virus / Trojan: No"
Typically seen on
legacy/academic Prospero deployments (rare); otherwise an anomaly
- Analyst note
- An open port 409/udp is unexpected given the absence of any documented modern legitimate use — treat as anomalous and investigate.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| prm-nm | UDP | Prospero Resource Manager Node Man. | 0.05% |
| prm-nm | TCP | Prospero Resource Manager Node Man. | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.