42

Port 42/tcp is unusual in the registry: it carries two service-name aliases, name and nameserver, both registered on TCP and UDP with the description "Host Name Server," a blank assignee, and a blank reference field. The registered service is the original ARPANET Host Name Server — a pre-DNS, centralized host-name lookup from the hosts.txt era — and it is emphatically not modern DNS, which lives on port 53. The IANA reference field is blank. The reason port 42 still matters in practice is a de-facto overlap: Microsoft's WINS (Windows Internet Name Service) uses TCP 42 for replication, the push/pull exchange that keeps WINS partner servers' NetBIOS-name databases in sync (the Wireshark dissector documents TCP 42 as the well-known WINS-replication port). That makes a clean separation important — IANA registers port 42 as the ARPANET "Host Name Server," but the traffic you actually see on it today is almost always WINS replication between Windows servers. Security-wise, the ARPANET service is obsolete, and WINS is a deprecated Microsoft legacy name service; Microsoft has published guidance on a WINS security issue (KB890710) recommending that inbound TCP and UDP 42 be blocked from the internet. For an analyst, an open 42 on a Windows host typically indicates a WINS server performing replication, which should never be internet-facing; on a Unix host it is more likely a vestigial name service. Either way the port points to legacy name-resolution infrastructure that warrants review and, ideally, migration off WINS.

IANA assignment

name and nameserver (two aliases) — "Host Name Server"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 42/tcp + 42/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low-to-moderate open-frequency in nmap-services (de-facto) [Well-established] — nmap-services file

Related ports

53 (DNS), 137 (NetBIOS Name Service)

De-facto use

Microsoft WINS replication (NOT the ARPANET registration)

Primary use (registered)

ARPANET Host Name Server (pre-DNS) [Well-established]

Other/unofficial uses

WINS replication between Windows partner servers

Security implications

ARPANET service obsolete; WINS is deprecated legacy; Microsoft KB890710 advises blocking inbound TCP/UDP 42 from the internet

Typically seen on

Windows WINS servers (replication); vestigial name services on old Unix hosts

Analyst note

An open 42 on Windows usually means a WINS replication server (never internet-facing); on Unix it's likely vestigial. IANA registers it as the ARPANET Host Name Server, but real traffic is typically WINS.

Port 42/udp is registered with IANA under two service names that point at the same description: name and its alias nameserver, both described as "Host Name Server," and both dual-registered on TCP as well as UDP. Every optional IANA column for this entry — Assignee, Contact, Registration Date, Modification Date, Reference, Service Code, Unauthorized Use Reported, and Assignment Notes — is blank, so IANA cites no RFC and records no registration date for port 42; those are genuine blanks, not gaps in our research. Historically the name refers to the ARPA Host Name Server Protocol (the NAMESERVER service, documented in IEN 116 and listed among the official protocols of its era in RFC 1011), a trivial hostname-to-address lookup service that predated DNS and is now obsolete. In practice, however, the dominant real-world use of port 42 became Microsoft's Windows Internet Name Service (WINS), the NetBIOS-name-to-IP resolution system: UDP 42 carried WINS name registration and query traffic while TCP 42 handled WINS replication between servers. Both identities are now legacy. The ARPA protocol was superseded by DNS (port 53) in the 1980s, and WINS is deprecated by Microsoft in favor of DNS and Active Directory–integrated DNS; WINS is not installed by default on any Windows Server release, so internet exposure is narrow and mostly confined to legacy enterprise networks that never migrated off NetBIOS. The reason port 42 matters to an analyst is mainly its WINS security history: MS09-039 (August 2009, rated Critical) patched two remote-code-execution flaws in the WINS service, CVE-2009-1923 and CVE-2009-1924, triggered by specially crafted WINS replication packets, and the earlier CVE-2004-1080 was another critical WINS RCE — Microsoft's standard mitigation in both cases was to block TCP and UDP port 42 at the firewall. As a UDP port it is theoretically exposed to reflection/amplification abuse if a responsive service is reachable, though no specific port-42 amplification vector is widely documented. Current SANS ISC data shows only low-level reconnaissance scanning against this port (threat level green), consistent with routine internet-wide scanning rather than active exploitation, so a responsive UDP 42 today most likely belongs to a legacy WINS deployment and is worth checking against the WINS patch history.

IANA assignment

name (alias nameserver) — "Host Name Server"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 42/tcp + 42/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

well-known (0–1023) [Confirmed]

IANA registration/modification date

none listed — IANA records no registration or modification date for port 42 [Confirmed] — IANA registry (columns blank)

IANA RFC reference

none cited in the registry for port 42; the underlying NAMESERVER protocol is documented in IEN 116 (not an RFC) and referenced by RFC 1011 [Confirmed] — IANA registry; Wikipedia "ARPA Host Name Server Protocol"

Current status

legacy / deprecated — ARPA NAMESERVER superseded by DNS (port 53); WINS deprecated by Microsoft in favor of DNS/AD-integrated DNS and not installed by default on any Windows Server [Confirmed] — Microsoft MS09-039 bulletin; Wikipedia "ARPA Host Name Server Protocol"

Related ports

DNS 53/tcp+udp (the protocol that superseded NAMESERVER); the NetBIOS cluster 137/138/139 and 445 (NetBIOS/SMB name and session services WINS interoperates with)

Primary use

historically the ARPA Host Name Server Protocol (NAMESERVER, IEN 116; listed in RFC 1011), a pre-DNS hostname-to-address lookup now obsolete

Other/dominant real-world use

Microsoft WINS (Windows Internet Name Service) for NetBIOS name resolution — UDP 42 for name registration/queries, TCP 42 for inter-server replication

Security implications

WINS on port 42 has a documented RCE history — MS09-039 (Aug 2009, Critical): CVE-2009-1923 + CVE-2009-1924 via crafted WINS replication packets; earlier CVE-2004-1080 (critical WINS RCE). Microsoft's mitigation for both: block TCP/UDP 42 at the firewall. UDP port → theoretical reflection/amplification surface if a responsive service is exposed, though no specific port-42 vector is widely documented

Exposure / scanning

SANS ISC reports ongoing low-level scanning of port 42 (current threat level green) — routine reconnaissance, not active exploitation; exposure narrow because WINS is never installed by default

Common software

Microsoft Windows Server WINS service (legacy, e.g. Windows Server 2003/2008); historically the tnamed daemon in early UNIX (absent from modern UNIX/Linux)

Typically seen on

legacy enterprise Windows networks still running WINS; otherwise an anomaly worth investigating

Analyst note

A responsive UDP 42 most likely indicates a legacy WINS deployment; check it against the WINS patch history (MS09-039 / CVE-2004-1080) and block at the perimeter if WINS is not in use.