422

Port 422/tcp is registered with IANA as ariel3 ("Ariel 3"), but no public protocol specification or known real-world application has been identified for it, so it is essentially never legitimately open and should be treated as anomalous rather than expected on any host, internal or internet-facing.

The IANA registry lists the service name ariel3, description "Ariel 3," assignee Joel Karafin, and a blank Reference field, with dual registration on both TCP and UDP. It sits alongside two sibling entries in the same name series: Ariel 1 on port 419, which shares the same registrant (Joel Karafin), and Ariel 2 on port 421, whose Assignee and Contact fields are both blank in the registry — forming a small sequential family of legacy registrations with no accompanying RFC or standards-track document found for any of them.

No credible documentation of what the Ariel protocol actually does was located. The previously-checked aggregator pages could not be read: t1shopper.com returned no response on either scheme, adminsub.net returned 522/523 (Cloudflare origin unreachable), and SpeedGuide 403s to every request — so no third-party claim about this port's real-world usage is carried forward. No vendor documentation, blog post, or forum/support thread describing actual software observed on this port was found.

IANA assignment

ariel3 — "Ariel 3"; reference (blank — no RFC cited); assignee Joel Karafin; dual-registered 422/tcp + 422/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 837-838)

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 422/tcp 0.000025 (paired 422/udp is 0.000346); no Shodan-style scan-exposure data specific to 422/tcp found [Confirmed / Unknown] — this site's own tooling

Related ports

Ariel 1 (419/tcp+udp) — same registrant (Joel Karafin); Ariel 2 (421/tcp+udp) — same name series only, registrant blank in registry [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ariel1 419/tcp, the IANA Service Name and Transport Protocol Port Number Registry ariel2 421/tcp

Primary use

undocumented — no RFC or public protocol specification found for "Ariel 3"

Other/unofficial uses

none documented in the wild; part of a sequential legacy "Ariel" family (Ariel 1/419, Ariel 3/422 share the registrant Joel Karafin; Ariel 2/421 shares only the name series — its Assignee and Contact fields are blank in the registry) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ariel1 419/tcp, the IANA Service Name and Transport Protocol Port Number Registry ariel2 421/tcp, the IANA Service Name and Transport Protocol Port Number Registry ariel3 422/tcp

Security implications

no verified CVEs or named malware families; no source that resolves attributes trojan or virus activity to this port [Unknown]

Typically seen on

Unknown; no known legitimate deployments documented [Unknown]

Analyst note

treat an open 422/tcp as anomalous — no documented protocol and no known application; investigate rather than assume a routine service.

Port 422/udp carries no service with a documented protocol or confirmed contemporary use; IANA reserves it under the name ariel3 ("Ariel 3"), but no RFC, no vendor specification, and no credible sighting of real-world software exist, so it should be treated as anomalous rather than expected on any network, public or internal.

The IANA Service Name and Transport Protocol Port Number Registry lists 422/udp jointly with 422/tcp under the service name ariel3, description "Ariel 3," and assignee Joel Karafin. The Reference field is blank and no assignment or modification date is recorded, consistent with a decades-old registration that predates routine RFC citation.

Port 422 sits in a small, undocumented cluster of adjacent System Ports registered under similar naming: 419 (ariel1), 421 (ariel2), and 423 (opc-job-start) surround it, and 422/tcp shares the same ariel3 registration. None of these ports has a published protocol specification, so beyond the bare service names nothing authoritative describes what the "Ariel" protocol does on the wire.

The previously-checked aggregator pages could not be read: SpeedGuide returns 403 to every request, PortsMaster 301-redirects off-domain, AuditMyPC's per-port URLs redirect to a generic port-search tool with no per-port content, and t1shopper.com returns no response on either scheme. No third-party claim about real-world use of 422/udp is carried forward.

IANA assignment

ariel3 — "Ariel 3"; reference (blank — no RFC or specification cited); assignee Joel Karafin; dual-registered 422/tcp + 422/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ariel3 422/tcp + ariel3 422/udp; IANA registry

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 422/udp 0.000346 (paired 422/tcp is 0.000025, so udp runs roughly 14x the tcp side) [Confirmed] — this site's own tooling

Related ports

422/tcp (same ariel3 registration, dual-registered); 419/tcp+udp (ariel1); 421/tcp+udp (ariel2); 423/tcp+udp (opc-job-start) [Confirmed dual-registration / Likely cluster framing] — IANA registry

Primary use

Unknown — IANA records only the bare service name and description; no RFC or protocol document is cited

Other/unofficial uses

Unknown — no source attributes non-"Ariel" software to this port; the previously-checked aggregator pages (SpeedGuide, PortsMaster, AuditMyPC, t1shopper.com) could not be read — 403, off-domain redirect, generic no-per-port-content redirect, and no response, respectively [Unknown]

Security implications

no CVE, vendor advisory, or scanning/honeypot report specific to 422/udp found; no source that resolves attributes malware to this port [Unknown]

Typically seen on

Unknown — no confirmed contemporary host type; historically an undocumented legacy System Port [Unknown]

Analyst note

An open 422/udp is rare and undocumented; treat as anomalous and investigate rather than assume routine "Ariel" service traffic.