43

Port 43/tcp is registered with IANA as nicname — not whois — with the description "Who Is" and a blank reference field (dual-registered on TCP and UDP). The service is the WHOIS query/response protocol, whose current specification is RFC 3912 (September 2004), which obsoleted RFC 954 and RFC 812. The protocol is about as simple as a protocol gets: the client opens a TCP connection to port 43, sends a single query line terminated by CRLF, and the server returns plaintext registration data for a domain, IP block, or autonomous system before closing the connection — with no encryption, authentication, or character-set negotiation. Its lineage runs back to the NAME/FINGER work in RFC 742 (1977) and the NICNAME/WHOIS service in RFC 812 (1982) by Ken Harrenstien and Vic White at SRI-NIC, with the first WHOIS directory maintained by Elizabeth Feinler's NIC team. The IANA reference field is blank. Security-wise, RFC 3912 is explicit that WHOIS "has no provisions for strong security" and lacks access control, integrity, and confidentiality; the data is plaintext, privacy concerns (sharpened by GDPR) have driven widespread redaction of registrant details, and WHOIS servers have occasionally been abused in injection- or SSRF-style chains via malicious referrals. The modern successor is RDAP (the Registration Data Access Protocol), a RESTful, HTTPS-based service over port 443 that adds structure, internationalization, and access control. For an analyst, an open 43 is normally a legitimate registry or registrar WHOIS server; on an unexpected host it may be a WHOIS proxy. The risk is low, but the protocol is plaintext and worth noting as such.

IANA assignment

nicname — "Who Is"; reference (blank — no RFC cited in IANA registry); dual-registered 43/tcp + 43/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low but non-trivial open-frequency in nmap-services (de-facto) [Well-established] — nmap-services file

Related ports

443 (RDAP over HTTPS), 4321 (RWhois)

Primary use

WHOIS registration-data lookup (RFC 3912)

Other/unofficial uses

registrar/registry WHOIS servers; WHOIS proxies [Well-established]

Security implications

plaintext, no auth/encryption/integrity (RFC 3912 §5); privacy/GDPR-driven redaction; occasional injection/SSRF via malicious referrals; RDAP (HTTPS/443) is the successor

Typically seen on

domain/IP/ASN registry and registrar servers

Analyst note

An open 43 is normally a legitimate registry/registrar WHOIS server (or a proxy on an odd host); low risk but plaintext.

Port 43/udp is registered with IANA as nicname with the description "Who Is" and a blank reference field; it is dual-registered, appearing identically on TCP and UDP under the same service name. The defining detail of this entry is the gap between the registry and the protocol: the WHOIS protocol itself is specified exclusively over TCP. RFC 3912 (Daigle, September 2004, which obsoletes RFC 954 and traces back to the original NICNAME/WHOIS of RFC 812, 1982) states that "a WHOIS server listens on TCP port 43 for requests from WHOIS clients" and makes no mention of UDP. The UDP assignment exists only as a mirrored entry — the long-standing IANA practice of reserving the same number on both transports for a well-known service — and carries no defined protocol behavior. In practice no mainstream WHOIS implementation speaks UDP/43: GNU whois, jwhois, the Windows built-in client, and the WHOIS servers run by Verisign, ARIN, RIPE NCC, APNIC, and gTLD registrars all use TCP/43, and ICANN's 2018 advisory requires gTLD registries and registrars to offer WHOIS on port 43 (TCP). For an analyst the practical reading is that 43/udp is a vestigial registry artifact: there is no documented production software on it and no documented exploitation specifically against the UDP variant. The real exposure surface lives on TCP/43 — WHOIS responses historically leaked registrant PII (now largely redacted post-GDPR), rogue-WHOIS-server hijack is possible if a registry's WHOIS hostname domain lapses and is re-registered, and WHOIS clients parsing untrusted server output can be targeted by response-injection. On TCP/43, WHOIS is also a routine passive-reconnaissance step in penetration tests (registrant org, abuse contacts, nameservers, registration/expiry dates, ASN associations). The UDP side, by contrast, is effectively dormant; outbound UDP/43 to arbitrary hosts is rarely legitimate and could warrant a look, but no concrete CVEs are documented against it.

IANA assignment

nicname — "Who Is"; reference (blank — no RFC cited in IANA registry); dual-registered 43/tcp + 43/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)

Range class

well-known (0–1023) [Confirmed]

Registration date

Unknown — IANA publishes no registration date for this entry; any "date registered" value in third-party port databases is a database artifact, not authoritative [Confirmed] — IANA registry has no date column populated for this row

Related ports

53 (DNS, the other core directory/registry service); 80/443 (RDAP, the JSON/HTTPS successor to WHOIS); contrast 79 (finger, an analogous early directory service)

Primary use

WHOIS/NICNAME directory lookup — but the protocol is defined over TCP only; UDP/43 has no defined protocol behavior

Protocol lineage

RFC 812 (NICNAME/WHOIS, 1982) → RFC 954 (1985) → RFC 3912 (2004, current; obsoletes 954); all specify TCP [Confirmed] — IETF Datatracker (https://datatracker.ietf.org/doc/rfc812/, https://datatracker.ietf.org/doc/html/rfc954, https://datatracker.ietf.org/doc/html/rfc3912)

Common software (TCP/43)

GNU whois, jwhois, Windows built-in whois; registry/registrar WHOIS servers (Verisign, ARIN, RIPE NCC, APNIC); ICANN 2018 advisory requires gTLD registries/registrars to offer port-43 WHOIS

Common software (UDP/43)

none documented in production use

Security implications (UDP/43)

no documented exploitation, no concrete CVEs, no active trojan/virus use specific to UDP/43; effectively dormant [Likely] — auditmypc.com marks current virus/trojan activity "No"; 2010 seclists thread notes no exploited vulnerabilities on port 43 (https://www.auditmypc.com/udp-port-43.asp, https://seclists.org/basics/2010/Aug/67)

Security implications (TCP/43, for context)

registrant-PII exposure (largely redacted post-GDPR); rogue-WHOIS-server hijack on lapsed WHOIS-hostname domains; response/SQL injection against clients parsing untrusted output

Assignee

IANA registry row leaves Assignee/Contact blank in the CSV; a separate IANA listing attributes the entry to Jon Postel [Likely] — registry CSV shows blank; assignee attribution from IANA .txt listing (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt)

Reconnaissance value

TCP/43 WHOIS is a standard passive-recon target (registrant org, abuse contacts, nameservers, dates, ASN); UDP/43 is not a meaningful pentest target as nothing responds [Confirmed] — HackTricks, verylazytech (https://book.hacktricks.xyz/network-services-pentesting/43-pentesting-whois, https://www.verylazytech.com/network-pentesting/whois-port-43)

Analyst note

43/udp is a mirrored IANA reservation with no defined UDP behavior and no documented use or exploitation. Real WHOIS traffic is TCP/43; treat unexpected UDP/43 as anomalous and investigate, but expect TCP for anything legitimate.