421
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No legitimate modern service or RFC documents this port, so an active listener or traffic on 421/tcp should be treated as anomalous and investigated rather than assumed benign.
- // analyst note
- dormant, undocumented IANA registration with no confirmed active legitimate use; treat traffic on it as worth investigating rather than routine.
- // if you see it open
- No confirmed active exploitation or scanning campaign found. GRC's Port Authority database lists a hedged, undated 'TCP Wrappers trojan' association drawn from older trojan/port compilation lists, not verified current threat intel. No RFC or vendor documentation describes a real protocol running on this port, so any observed traffic is anomalous.
About port 421/tcp.
Port 421/tcp is registered with IANA under the service name ariel2 ("Ariel 2"), but no RFC or vendor documentation describes what the protocol actually does, and no software is known to implement it today — so a listener on 421/tcp is not an expected legitimate service and should be treated as anomalous rather than assumed benign.
The IANA Service Name and Transport Protocol Port Number Registry lists 421 as dual-registered on both TCP and UDP, with description "Ariel 2." The Assignee, Contact, Reference, and date fields are all blank in the source registry — this is a sourced absence, not an omission on our part, and no RFC has ever backed the assignment.
The name places it in a small cluster of adjacent, similarly thin registrations — ariel1 (419/tcp,udp) and ariel3 (422/tcp,udp) — suggesting a single vendor or project once reserved a short run of port numbers. No documentation describing the "Ariel" protocol itself could be located in registry text, RFC indexes, or general web search.
No current, credible source (vendor documentation, blog post, or forum/support thread) reports specific software actively generating traffic on port 421. The only security-relevant reference found is a legacy, undated entry in a historical trojan-port compilation.
- IANA assignment
ariel2— "Ariel 2"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 421/tcp + 421/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- 0.000000 — nmap-services open-frequency figure; the port was measured and never observed open [Confirmed] — this site's own tooling
- Related ports
ariel1(419/tcp,udp),ariel3(422/tcp,udp) — same registered cluster [Likely] — IANA registry
Primary use
undocumented legacy registration "Ariel 2"; no RFC or protocol documentation located describing actual function
Other/unofficial uses
none identified; part of a registered ariel1/ariel2/ariel3 cluster spanning ports 419–422
Security implications
legacy, undated "TCP Wrappers trojan" association carried in GRC's Port Authority database, sourced from older trojan/port compilation lists rather than confirmed current threat-intel reporting; no modern scanning-campaign or honeypot reporting specific to port 421 was found
Typically seen on
no legitimate modern host role identified; an active listener on port 421 would be atypical [Unknown]
- Analyst note
- dormant, undocumented IANA registration with no confirmed active legitimate use; treat traffic on it as worth investigating rather than routine.
About port 421/udp.
Port 421/udp is registered with IANA under the short name ariel2 ("Ariel 2"), but IANA's registry provides no accompanying RFC or specification, so what actually implements this protocol — and whether it belongs on the public internet — cannot be confirmed from primary sources; treat any observed traffic here as unidentified until specifically investigated.
IANA's Service Name and Transport Protocol Port Number Registry confirms dual registration: both 421/tcp and 421/udp carry the name ariel2, with the description "Ariel 2." The assignee and reference fields are both blank in the registry — IANA cites no defining document for this assignment.
No credible source was found describing specific software or services generating traffic on 421/udp today. Community port-lookup aggregators were checked directly and none produced usable attribution: SpeedGuide blocked automated access and PortsMaster redirected off-domain. No malware association is confirmed for 421/udp — no named family, sample, CVE, or dated incident — and application attribution is left unknown rather than guessed.
- IANA assignment
ariel2— "Ariel 2"; reference (blank — no RFC cited in IANA registry); assignee (blank); dual-registered 421/tcp + 421/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed] — IANA registry (numeric position)
- Prevalence
- 0.000428 for 421/udp; the paired 421/tcp figure is exactly 0.000000, a real measured zero — nmap-services open-frequency figures [Confirmed] — this site's own tooling
- Related ports
- 421/tcp (dual registration, same
ariel2name) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry
Primary use
bare registry label "Ariel 2" with no RFC or specification and no deployment documentation
Other/unofficial uses
Unknown — no credible source describes unofficial or de-facto uses [Unknown]
Security implications
no confirmed CVE and no confirmed malware association for 421/udp [Unknown]
Typically seen on
Unknown — no confirmed deployment context identified [Unknown]
- Analyst note
- An open port 421/udp with no confirmed service behind it should be treated as unidentified traffic worth investigating rather than assumed to be legitimate "Ariel 2" activity, given the total absence of specification or deployment documentation.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ariel2 | UDP | — | 0.04% |
| ariel2 | TCP | Ariel 2 | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.