430
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No documented protocol, vendor implementation, or confirmed current deployment exists for utmpsd, so an open 430/tcp is not expected in normal traffic and should be investigated as anomalous or unrecognized rather than assumed to be a legitimate service.
- // analyst note
- treat an open 430/tcp as anomalous/unrecognized traffic rather than assume a legitimate service; the "UTMP relay" naming interpretation is an unverified inference, not a confirmed protocol.
- // if you see it open
- No CVE is recorded in the NVD for port 430 as of an August 2026 search, and no malware or trojan association is documented. auditmypc.com's port 430 page and GRC's Shields Up Port Authority entry both carry no security notes of their own - GRC echoes only the bare IANA service name. No documented protocol or vendor implementation exists, so an open 430/tcp has no established legitimate reason to be reachable and should be treated as anomalous.
About port 430/tcp.
Port 430/tcp is registered to utmpsd, but IANA supplies only a bare service name with no RFC, no assignee, and no protocol specification, and no vendor implementation has been confirmed as of an August 2026 search; an open 430/tcp therefore has no established legitimate reason to be reachable from the public internet and should be treated as anomalous rather than routine traffic.
The IANA Service Names and Port Numbers registry lists utmpsd on both 430/tcp and 430/udp, description "UTMPSD," with the Reference, Assignee, and Contact columns all blank and no registration date recorded. Port 431 (utmpcd, "UTMPCD") sits immediately adjacent in the registry and reads as a plausible client-side companion, though IANA does not itself document any relationship between the two entries.
The name plausibly points to a UTMP server daemon: Unix and Linux systems log active sessions in a utmp/wtmp file, and older rwho- and finger-adjacent tooling relayed that "who is logged in" data between hosts. No RFC, vendor page, or software repository confirms an actual protocol or implementation running on this port, so that reading remains an unverified inference rather than a documented fact.
No CVE is recorded in the NVD for port 430 as of an August 2026 search, and no malware or trojan association is documented. auditmypc.com's port 430 page and GRC's Shields Up Port Authority entry both carry no security notes of their own — GRC merely echoes the bare IANA service name.
- IANA assignment
utmpsd— description "UTMPSD"; Reference, Assignee, and Contact columns blank; dual-registered 430/tcp + 430/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry utmpsd 430/tcp; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 430/tcp = 0.000000 (sampled, not observed open); 430/udp ≈ 0.000362 [Confirmed] — this site's own tooling
- Related ports
- 431/tcp + 431/udp (
utmpcd, "UTMPCD") — adjacent registry entry, a plausible client-side companion name, though not documented by IANA as formally related [Likely] — the IANA Service Name and Transport Protocol Port Number Registry utmpcd 431/tcp
Primary use
Unknown beyond the bare IANA label — utmpsd plausibly names a UTMP-relay/session-listing daemon by naming convention, but no RFC, vendor page, or implementation confirms actual protocol behavior
Other/unofficial uses
none found in vendor docs, blogs, forums, or software repositories as of an August 2026 search [Unknown]
Security implications
no CVE recorded in the NVD and no malware/trojan association documented as of an August 2026 search; auditmypc.com and GRC Shields Up carry no security notes for port 430
Typically seen on
Unknown as of an August 2026 search — no vendor or software attribution found [Unknown]
- Analyst note
- treat an open 430/tcp as anomalous/unrecognized traffic rather than assume a legitimate service; the "UTMP relay" naming interpretation is an unverified inference, not a confirmed protocol.
About port 430/udp.
Port 430/udp is registered to utmpsd, a legacy Unix login/session status service with no RFC behind it and no confirmed modern deployment; it has no legitimate reason to be reachable from the public internet, and an open instance today should be treated as an anomaly worth investigating rather than as routine infrastructure.
IANA's service-names-port-numbers registry dual-registers port 430 to the service name utmpsd on both TCP and UDP. The Description column carries only "UTMPSD"; the Reference and Assignee columns are both blank — no RFC or standards document backs the assignment, and no registrant contact is on file for either transport.
The service name suggests a Unix utmp/wtmp status-query daemon — a class of service, alongside protocols like rwho, that reports which accounts are currently logged in on a host. No wire-protocol specification was found, and no web search as of August 2026 turned up vendor documentation, forum discussion, or software confirmed to implement it, so the inference stays a likely reading rather than a verified fact.
nmap-services' open-frequency sampling puts 430/udp at roughly 0.036% (0.000362) and 430/tcp at exactly 0% — a real sampled reading rather than a missing data point. Both figures are consistent with a port that almost never turns up open in real-world scans.
- IANA assignment
utmpsd— description "UTMPSD"; Reference blank (no RFC cited); Assignee blank; dual-registered 430/tcp + 430/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry utmpsd 430/udp- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry utmpsd 430/udp
- Prevalence
- nmap-services open-frequency 430/udp ≈ 0.000362 (~0.036%); 430/tcp = 0 (a real sampled reading, not an absence) [Confirmed] — this site's own tooling
- Related ports
- 431/tcp+udp
utmpcd, an adjacent legacy status-daemon registration in the same IANA neighborhood [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry utmpcd 431/udp
Primary use
inferred Unix utmp/wtmp login-session status query service, akin to rwho; no RFC or formal specification found
Other/unofficial uses
none identified — no vendor docs, forum threads, or community sightings of software using this port turned up in an August 2026 search [Unknown]
Security implications
no CVE recorded in the NVD as of 2026-08; no credible malware/trojan association found as of an August 2026 search
Typically seen on
no confirmed hosts or products; legacy Unix systems are the only plausible historical fit given the service name and era [Unknown]
- Analyst note
- An open 430/udp has no confirmed legitimate modern use — treat it as anomalous, a possible decoy, or grounds to fingerprint the responding host/application directly rather than assuming a known service [Likely] — synthesized from the registry and prevalence findings above
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| utmpsd | UDP | — | 0.04% |
| utmpsd | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.