425
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No confirmed software, protocol behavior, or legitimate deployment is documented for this legacy individual registration, so an open port 425 is unexpected and should be investigated rather than assumed routine.
- // analyst note
- Treat an open port 425 as unexplained — verify the actual service behind it rather than assuming ICAD, and rule out generic mass-scan noise before escalating.
- // if you see it open
- No confirmed software or protocol runs on 425/tcp. SANS Internet Storm Center shows only low-volume, generic background-noise scanning consistent with routine mass port sweeps, not targeted exploitation. No source that resolves attributes a named malware or trojan family to port 425. The FTP '425 Can't open data connection' response code is an unrelated FTP status code and should not be conflated with traffic on TCP port 425.
About port 425/tcp.
Port 425/tcp carries no confirmed protocol or software; IANA's registry lists it only as a legacy "icad-el" ("ICAD") assignment credited to Larry Stone, with no RFC and no public specification describing what the service actually does. Because nothing verifiable runs here, a live listener on 425/tcp should not be assumed legitimate and merits investigation rather than public-internet exposure.
The IANA Service Name and Transport Protocol Port Number Registry dual-registers icad-el on both TCP and UDP, with a blank Reference field — a hallmark of an early, individually-sponsored registration rather than a protocol standardized through the RFC process. No registration date is recorded, and no vendor documentation, forum thread, or technical writeup describing "ICAD" traffic on this port could be found.
Search results conflating port 425 with the FTP "425 Can't open data connection" response code are a false lead — that is an FTP status/error code unrelated to any software or protocol bound to TCP port 425 — and research citing it as evidence of port usage should be disregarded.
SANS Internet Storm Center data shows only low-volume, generic background scanning against port 425, consistent with routine mass port sweeps rather than targeted exploitation of a known service. No source consulted for this entry — the IANA registry or SANS ISC — attributes a named malware or trojan family to port 425.
- IANA assignment
icad-el— "ICAD"; reference (blank — no RFC cited in IANA registry); assignee Larry Stone; dual-registered 425/tcp + 425/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 843-844; IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- 0.000326 — nmap-services open-frequency figure (roughly 3 openings per 10,000 hosts scanned) [Confirmed] — this site's own tooling
- Related ports
- No close functional relatives identified from the research for this entry
Primary use
Unknown — no public specification or vendor documentation describes the icad-el protocol beyond the bare registry name
Other/unofficial uses
None credibly documented; no known software was found to commonly generate traffic on this port [Unknown]
Security implications
Low-volume, generic internet background scanning observed; no source that resolves attributes a named malware or trojan family to port 425; the unrelated FTP "425" response code should not be conflated with port-425 traffic
Typically seen on
No known legitimate deployment identified; an open port 425 is an anomaly [Unknown]
- Analyst note
- Treat an open port 425 as unexplained — verify the actual service behind it rather than assuming ICAD, and rule out generic mass-scan noise before escalating.
About port 425/udp.
Port 425/udp is IANA-registered to the service name icad-el (registry description simply "ICAD"), but no publicly documented protocol, RFC, or software implementation describes what actually runs on it. With no known legitimate use, this port has no business being reached from the public internet, and a live listener should be treated as an anomaly warranting investigation rather than assumed to be a normal service.
IANA's registry lists icad-el as dual-registered on both 425/tcp and 425/udp, with Larry Stone recorded as both assignee and contact and the reference field left blank — no RFC or other specification is cited. No registration date is recorded. This registration is confirmed against the cached IANA registry, the IANA Service Name and Transport Protocol Port Number Registry lines 843-844.
No vendor documentation, forum discussion, or contemporary software was found reporting active use of 425/udp for ICAD's registered purpose. SANS Internet Storm Center's port-425 activity page shows only low-volume, routine internet-wide background-scan traffic — a handful of source IPs per day — consistent with generic port sweeps rather than a targeted campaign, and lists no CVEs or malware family tied to the port.
No source consulted for this entry attributes a named malware or trojan family to port 425/udp. Given the absence of any real service, an open 425/udp is best treated as a fingerprinting or anomaly signal.
- IANA assignment
icad-el— "ICAD"; reference (blank — no RFC cited in the registry); assignee Larry Stone; dual-registered 425/tcp + 425/udp [Confirmed] — cached IANA registry (the IANA Service Name and Transport Protocol Port Number Registry lines 843-844)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- 0.000428 — nmap-services open-frequency figure (roughly 4 openings per 10,000 hosts scanned) [Confirmed] — this site's own tooling
- Related ports
- 425/tcp (same icad-el dual registration) [Confirmed] — cached IANA registry
Primary use
Unknown — no publicly documented protocol, RFC, or software describes ICAD's function [Unknown]
Other/unofficial uses
none documented [Unknown]
Security implications
essentially never legitimately open; SANS ISC shows only routine background-scan traffic with no CVEs or named malware family attributed to this port
Typically seen on
no known legitimate hosts or services; an open listener is an anomaly [Unknown]
- Analyst note
- An open 425/udp has no documented legitimate purpose — treat as a fingerprinting/anomaly signal and investigate rather than assume it is a normal service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| icad-el | UDP | — | 0.04% |
| icad-el | TCP | ICAD | 0.03% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.