418

Port 418/tcp is registered with IANA for hyper-g (Hyper-G); it is a legacy assignment with no evidence of active modern deployment, so a port 418 seen open today does not belong on the public internet and should be treated as unexplained rather than assumed legitimate.

IANA lists the service name hyper-g, description "Hyper-G," assignee Frank Kappe, and dual registration on both TCP and UDP; the Reference column is blank, so no RFC backs the assignment. Hyper-G itself was an early-1990s hypermedia/information system developed at Graz University of Technology, a contemporary of early Gopher/WWW-era systems.

The number is unrelated to HTTP status code 418 ("I'm a teapot," RFC 2324 / RFC 7168, the Hyper Text Coffee Pot Control Protocol); HTCPCP rides on ordinary HTTP and specifies no dedicated port, so the shared "418" is coincidental rather than a technical link.

SANS ISC records only routine, low-volume background scanning on port 418, with a threat level of Green (low) and no CVE or advisory tied to the port. One uncorroborated community submission on that same page claims the port has been used for remote administration of Symantec Enterprise Firewall (formerly Axent Raptor); it is a single, hedged report, not a vendor-confirmed fact.

IANA assignment

hyper-g — "Hyper-G"; reference (blank — no RFC cited); assignee Frank Kappe; dual-registered 418/tcp + 418/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed]

Prevalence

0.000025 [Confirmed] — this site's own tooling

Related ports

no directly related cluster identified for this legacy hypermedia-era assignment [Unknown]

Primary use

Hyper-G, an early-1990s hypermedia/information system from Graz University of Technology; no evidence of active modern deployment

Other/unofficial uses

single hedged community report of Symantec Enterprise Firewall (Raptor) remote-admin traffic

Security implications

essentially no legitimate modern use is documented; SANS ISC reports only low-volume background scanning, threat level Green, no CVE/advisory tied to the port

Typically seen on

no current legitimate deployment identified; otherwise treat as an anomaly [Likely]

Analyst note

HTTP 418 "I'm a teapot" (RFC 2324/7168) is unrelated — coincidental shared number only, not a technical link [Confirmed] — Wikipedia, Hyper Text Coffee Pot Control Protocol

Port 418/udp is registered to hyper-g, the service name for Hyper-G, a defunct early-1990s distributed hypermedia system; it is unrelated to the HTTP 418 "I'm a teapot" status code, has no known legitimate modern use, and an open 418/udp should generally be treated as anomalous rather than expected on any network.

IANA lists 418 as dual-registered on both TCP and UDP under the service name hyper-g, description "Hyper-G," and assignee Frank Kappe. The Reference, Registration Date, and Modification Date columns are all blank in the registry — no RFC was ever cited for this assignment.

Hyper-G (HG-CSP) was developed starting in 1989 at IICM, Graz University of Technology, Austria, led by Hermann Maurer and Frank Kappe. Its first real deployment was the TU Graz University Information System in 1992, and the system was later commercialized as Hyperwave. It predates the modern web and saw limited academic/commercial adoption before fading out.

A caution for anyone researching this port: RFC 2324's April Fools' HTTP status code 418, "I'm a teapot," is a completely separate thing from port number 418 — HTCPCP itself runs over ordinary HTTP on port 80, not port 418. Several low-quality port-lookup sites incorrectly conflate the two, and that conflation should not leak into analysis of this port.

Scan telemetry for 418/udp is unremarkable: SANS ISC's port-418 activity page (retrieved 2026-08-01) shows only routine, low-volume background scan noise from scattered source IPs, with no associated CVEs and a green/low threat rating. One unverified 2005 online comment claims the port was used for remote administration of Symantec Enterprise Firewall (formerly Axent Raptor); it is uncorroborated by any other source and is noted here only as a low-confidence data point, not an established fact.

IANA assignment

hyper-g — "Hyper-G"; reference (blank — no RFC cited in IANA registry); assignee Frank Kappe; dual-registered 418/tcp + 418/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 829–830); iana.org/assignments/service-names-port-numbers

Range class

well-known (0–1023) [Confirmed]

Prevalence

0.000544 [Confirmed] — this site's own tooling

Related ports

none identified as directly related by research [Unknown]

Primary use

Hyper-G (HG-CSP), a distributed hypermedia information system developed from 1989 at IICM, Graz University of Technology, led by Hermann Maurer and Frank Kappe; first deployed 1992 as the TU Graz University Information System; later commercialized as Hyperwave

Other/unofficial uses

single unverified 2005 online comment reports use for remote administration of Symantec Enterprise Firewall (formerly Axent Raptor); no other corroborating sightings found

Security implications

essentially never legitimately open today given the defunct protocol; SANS ISC shows only routine low-volume scan noise, no associated CVEs, green/low threat rating

Typically seen on

no current legitimate deployments identified; treat as an anomaly if observed [Likely]

HTTP-teapot conflation

RFC 2324 "I'm a teapot" HTTP status code is unrelated to this port; HTCPCP runs on port 80 [Confirmed] — developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/418

Analyst note

An open 418/udp is unexpected today; investigate rather than assume benign, and do not confuse the port number with HTTP status 418.