431
Summary
- // typical exposure
- Internal-only — Even without a confirmed protocol spec, the utmp-rooted name and the 430/431 send/copy pairing point to host-to-host login-record synchronization, an administrative function with no legitimate reason to face the public internet.
- // analyst note
- an open 431/tcp has no confirmed legitimate protocol behind it; treat as an unexplained legacy service and investigate rather than assume routine traffic.
- // if you see it open
- No CVE is recorded in the NVD as of this August 2026 search (keyword 'utmpcd', 0 results), and no malware or trojan family is documented against port 431. No vendor page, blog post, or forum thread describing real-world deployment was found; port-lookup aggregator sites only restate the bare IANA label. Given the lack of any confirmed legitimate implementation, an open 431/tcp should be treated as an unexpected legacy service worth investigating.
About port 431/tcp.
Port 431/tcp carries utmpcd, an obscure legacy Unix service; IANA documents no protocol behavior beyond the bare label, but the utmp-rooted name and its pairing with port 430 (utmpsd) point to host-to-host login-record synchronization — an administrative function that should stay internal-only rather than face the public internet.
IANA's registry lists utmpcd on both 431/tcp and 431/udp with description "UTMPCD" — identical to the service name — and blank Assignee, Contact, and Reference fields, so no RFC or named registrant is on record. Port 430 carries the parallel entry utmpsd, also blank across those same columns.
The names suggest a client/server pair from Unix's utmp/wtmp login-accounting era (the same administrative-tooling family as rwho and rusers): utmpsd as a "send" side and utmpcd as a "copy" side propagating login-session state between hosts, echoing the collector/managed-node pattern documented for other legacy port pairs like 381/382. No primary source confirms this reading; treat it as inference, not fact.
No CVE is recorded in the NVD as of this August 2026 search for utmpcd or port 431, and no malware or trojan family is documented against it. No vendor page, blog post, or forum thread describing a real deployment was found; port-lookup aggregator sites only restate the bare IANA label. In nmap's scan corpus, 431/tcp shows an open-frequency of 0 (sampled, not observed open), while 431/udp shows roughly 0.00046.
- IANA assignment
utmpcd— description "UTMPCD" (identical to the service name); reference (blank — no RFC cited); assignee Unknown (blank Assignee/Contact columns); dual-registered 431/tcp + 431/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry utmpcd 431/tcp- Range class
- well-known (0–1023) [Confirmed] — this site's own tooling
- Prevalence
- nmap-services open-frequency 431/tcp = 0.000000 (sampled, not observed open); 431/udp ≈ 0.000461 [Confirmed] — this site's own tooling
- Related ports
- 430/tcp + 430/udp (utmpsd — likely paired send-side counterpart; same blank-registry pattern) [Likely] — the IANA Service Name and Transport Protocol Port Number Registry utmpsd 430/tcp
Primary use
Unknown — no protocol specification is on record beyond the bare label; the utmp-rooted name and the pairing with port 430 (utmpsd) suggest legacy host-to-host login-record synchronization, but this is inference from naming/registry adjacency, not a documented fact
Other/unofficial uses
none found — no vendor documentation, blog post, or forum thread describing software using this port as of this August 2026 search
Security implications
no CVE recorded in the NVD as of this August 2026 search (keyword "utmpcd", 0 results); no malware or trojan family documented against port 431 in sources checked
Typically seen on
Unknown — no current software attribution found; if the inferred purpose holds, legacy Unix hosts running a paired utmp-synchronization daemon (obsolete) [Unknown]
- Analyst note
- an open 431/tcp has no confirmed legitimate protocol behind it; treat as an unexplained legacy service and investigate rather than assume routine traffic.
About port 431/udp.
Port 431/udp is registered with IANA under the name utmpcd; the registry supplies no RFC, no specification, and no assignee for the entry, so what actually implements the service — and whether it belongs on the public internet — cannot be confirmed from primary sources, and any traffic observed here should be treated as unidentified until specifically investigated.
IANA's Service Name and Transport Protocol Port Number Registry dual-registers port 431 as utmpcd on both TCP and UDP. The Description column for each row reads literally "UTMPCD" — the same string in uppercase, not an expanded explanation — and the Assignee, Reference, Registration Date, and Modification Date columns are all blank.
The name plausibly points to a Unix utmp-related accounting daemon — utmp is the traditional Unix file recording currently logged-in users — but no RFC, vendor document, or deployment guide was found that confirms this etymology or describes an actual wire protocol; treat it as an unverified guess about the name's origin, not a documented service definition.
No specific application, vendor product, or client/server software was found, in an August 2026 search, credibly documented as using UDP port 431; only generic port-lookup aggregator sites echo the bare IANA registration. No CVE referencing 431/udp is recorded in the NVD as of 2026-08, and no malware or trojan association is documented for this port.
- IANA assignment
utmpcd— Description column reads literally "UTMPCD" (no expanded text, same string in uppercase); reference (blank — no RFC cited); assignee (blank); dual-registered 431/tcp + 431/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry utmpcd 431/udp, utmpcd 431/tcp- Range class
- well-known (0–1023) [Confirmed] — IANA registry (numeric position)
- Prevalence
- nmap-services open-frequency 431/udp = 0.000461 (~0.046%); the paired 431/tcp figure is exactly 0.000000, a real measured zero [Confirmed] — this site's own tooling
- Related ports
- 431/tcp (dual registration, same
utmpcdname) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry utmpcd 431/tcp
Primary use
bare registry label utmpcd with no RFC, specification, or deployment documentation; the name plausibly points to a Unix utmp-accounting daemon, but this etymology is unconfirmed
Other/unofficial uses
Unknown — no credible source describes unofficial or de-facto uses [Unknown] — https://www.speedguide.net/port.php?port=431, http://www.t1shopper.com/tools/port-number/431/, https://portsmaster.org/port-431/
Security implications
no CVE recorded in the NVD as of 2026-08; no malware/trojan association documented as of an August 2026 search
Typically seen on
Unknown — no confirmed deployment context identified [Unknown]
- Analyst note
- An open port 431/udp with no confirmed service behind it should be treated as unidentified traffic worth investigating, given the total absence of specification, assignee, or deployment documentation — the
utmpcdname is a plausible but unverified hint at a Unix login-accounting daemon, not a confirmed identification.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| utmpcd | UDP | — | 0.05% |
| utmpcd | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.