429
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No documented protocol, vendor implementation, or legitimate deployment exists for ocs-amu, so an open 429/tcp is not expected in normal traffic and should be treated as anomalous or unrecognized rather than an intentional internet-facing or internal service.
- // analyst note
- treat an open 429/tcp as anomalous/unrecognized traffic and investigate rather than assume a legitimate service.
- // if you see it open
- No documented CVEs, malware associations, or exposure/scanning write-ups were found for port 429. GRC's Port Authority listing carries no security notes for it. Absent any known legitimate implementation, an open 429/tcp should be treated as anomalous rather than assumed benign.
About port 429/tcp.
Port 429/tcp carries no documented protocol: IANA registers it under the service name ocs-amu (description "OCS_AMU"), but no RFC, specification, or independent write-up defines what actually runs there, so it should not be treated as a recognized public-facing service and an open 429/tcp is best read as anomalous rather than routine traffic.
IANA's registry lists ocs-amu as the current name for both 429/tcp and 429/udp, replacing a historic alias ocs_amu that is flagged as not usable with many common service-discovery mechanisms. The Reference column is blank — no RFC or IETF document is cited — and the registry records only a contact name, [Florence_Wyman], alongside the bare label, with nothing further describing behavior.
No vendor documentation, blog post, forum thread, or scanning/exposure write-up was found describing real software using port 429/tcp. Third-party port-lookup aggregator pages merely echo the IANA label without adding attribution, and two additional lookups failed outright (403 and 522 errors) during this research pass, so they are not used as sources. No malware or backdoor association for this port surfaced either.
- IANA assignment
ocs-amu(historic aliasocs_amu) — description "OCS_AMU"; Reference column blank; assignee [Florence_Wyman]; dual-registered 429/tcp + 429/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 0.000000 [Confirmed] — this site's own tooling; the port was sampled and no open instances were observed. No further dated scanning/telemetry write-ups found beyond this figure [Unknown]
- Related ports
- none identified as directly related [Unknown]
Primary use
Unknown — no protocol specification or RFC beyond the bare label "OCS_AMU"
Other/unofficial uses
none found in vendor docs, blogs, or forums [Unknown]
Security implications
no documented CVEs, malware, or exposure telemetry found
Typically seen on
Unknown — no software or vendor attribution found [Unknown]
- Analyst note
- treat an open 429/tcp as anomalous/unrecognized traffic and investigate rather than assume a legitimate service.
About port 429/udp.
Port 429/udp carries no documented protocol: IANA registers it under the service name ocs-amu (description OCS_AMU), but no RFC, specification, or independent write-up defines what actually runs there, so it should not be treated as a legitimate public-facing service — an open 429/udp is best read as anomalous rather than routine traffic.
IANA's registry lists ocs-amu as the current name for both 429/udp and 429/tcp, replacing a historic alias ocs_amu that is marked deprecated and unsuitable for modern service-discovery mechanisms. The Reference column is blank — no RFC or IETF document is cited — and the registry records only a contact name, [Florence_Wyman], alongside the bare description string; nothing further about the protocol's mechanics is specified.
Web searches for the "OCS" prefix surface unrelated technologies — Open Collaboration Services (an ownCloud/KDE API) and the Online Certificate Status Protocol (OCSP) — neither connected to this port. OCS_AMU is simply IANA's literal description string for the ocs-amu assignment, and no specification ties it to either of those unrelated technologies.
No vendor documentation, blog post, forum thread, or scanning write-up describing real software on port 429/udp was found. Third-party port-lookup aggregators — SpeedGuide, adminsub.net, ports.my-addr.com, and t1shopper.com — merely echo the bare IANA label with no independent attribution. No CVE, exploit writeup, or malware association names this port as of an August 2026 search.
- IANA assignment
ocs-amu(historic aliasocs_amu, deprecated) — descriptionOCS_AMU; Reference column blank; assignee/contact[Florence_Wyman]; dual-registered 429/tcp + 429/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ocs-amu 429/udp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 429/udp = 0.000428 (~0.043%); the sibling 429/tcp reads 0.000000 (sampled, not observed open) [Confirmed] — this site's own tooling
- Related ports
- 429/tcp — identical
ocs-amudual registration, same assignee [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ocs-amu 429/tcp
Primary use
Unknown — no protocol specification or RFC beyond the bare description OCS_AMU; formally registered but functionally undocumented, consistent with an obscure or likely-defunct legacy assignment
Other/unofficial uses
none found; the name is unrelated to the similarly-prefixed Open Collaboration Services or Online Certificate Status Protocol (OCSP) [Unknown]
Security implications
no CVE, exploit writeup, or malware/trojan association found for 429/udp as of an August 2026 search [Unknown]
Typically seen on
Unknown — no software or vendor attribution found [Unknown]
- Analyst note
- treat an open 429/udp as anomalous/unrecognized traffic and investigate rather than assume a legitimate service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ocs_amu | UDP | — | 0.04% |
| ocs_amu | TCP | ocs-amu | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.