433

Port 433/tcp is registered with IANA as nnsp with the description "NNTP for transit servers (NNSP)," assignee IESG (contact the IETF Chair), a modification date of 2018-07-06, and a reference of [RFC3977] — one of only two entries in its batch whose IANA Reference field is not blank (dual-registered on TCP and UDP). Its purpose is the bulk server-to-server transfer (peering or transit) of Usenet news articles, as opposed to client-server reading and posting NNTP on port 119. NNTP is specified in RFC 977 (1986) and updated by RFC 3977 (October 2006), which states that the official NNTP port is 119 but that a host offering separate servers for transit and reading clients should use port 433 for the transit server and 119 for the reading server; transit mode uses the IHAVE command while reading mode uses the READER command set, and "NNSP" is the informal name for this transit subset. The IANA reference field is [RFC3977]. Security-wise the port shares the same general class of issues as NNTP — plaintext, subject to eavesdropping and news abuse — and it is niche and rarely seen today, with encrypted client news using nntps on 563 (RFC 4642) and no notable port-specific CVE history. For an analyst, an open 433 is an uncommon news-transit endpoint, and on a modern network it is more likely a misconfiguration or unusual legacy service than active Usenet peering.

IANA assignment

nnsp — "NNTP for transit servers (NNSP)"; reference [RFC3977]; assignee IESG (IETF Chair contact); modification date 2018-07-06; dual-registered 433/tcp + 433/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

effectively nil; nmap-services open-frequency ~0.000000 (de-facto) [Well-established] — nmap-services file

Related ports

119 (nntp, client-server), 563 (nntps, NNTP over TLS)

Primary use

server-to-server (transit/peering) Usenet news transfer (RFC 3977)

Other/unofficial uses

none meaningful today [Well-established]

Security implications

same class as NNTP (plaintext, news abuse); niche; encrypted client news is nntps/563 [Well-established]

Typically seen on

NNTP news server farms doing feeds (rare)

Analyst note

An open 433 is an uncommon news-transit endpoint; on a modern network more likely a misconfiguration or unusual legacy service than active Usenet peering.

Port 433/udp carries the IANA-registered service name nnsp — "NNTP for transit servers (NNSP)," the same registration paired with 433/tcp — but no software has been confirmed to generate genuine traffic over UDP specifically, so it should not be expected, and should not be allowed inbound from the public internet.

IANA pairs 433/udp with 433/tcp under the identical nnsp registration: assignee IESG (contact: IETF Chair), reference [RFC3977], and a modification date of 2018-07-06. The registration date itself is blank in the registry, as it is for many older entries.

NNSP is the informal name for NNTP's transit/peering mode — bulk server-to-server exchange of Usenet news articles, distinct from the client-facing reading service on 119/tcp. RFC 3977 (Oct 2006) documents NNTP but defines no UDP transport mode; NNTP and NNSP traffic are conventionally carried over TCP.

No specific software was confirmed generating real traffic on 433/udp: historical Usenet transit daemons such as INN run over TCP, and the paired UDP registration reads as a formality alongside 433/tcp rather than evidence of deployed usage. Community-sourced searches (vendor docs, forums) surfaced nothing beyond generic port-directory mirrors of the IANA entry and unrelated hobbyist 433 MHz RF-to-network gateway projects, which use "433" for the radio band, not this port.

Measured prevalence is negligible either way: nmap-services records an open-frequency of 0.000445 for 433/udp against 0.000000 for the paired 433/tcp row — both consistent with a niche, little-deployed legacy registration rather than an actively scanned service.

IANA assignment

nnsp — "NNTP for transit servers (NNSP)"; reference [RFC3977]; assignee IESG (contact: IETF Chair); modification date 2018-07-06; registration date blank; dual-registered 433/tcp + 433/udp with identical service details

[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nnsp 433/udp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nnsp 433/udp

Prevalence

nmap-services open-frequency 433/udp ≈ 0.000445 (~0.04%); 433/tcp = 0.000000 [Confirmed] — this site's own tooling

Related ports

433/tcp (dual IANA registration, same nnsp name); 119/tcp (nntp, client-facing reading); 563/tcp (nntps, NNTP over TLS) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nnsp 433/tcp

Primary use

server-to-server (transit/peering) Usenet news transfer — the same nnsp function as 433/tcp — but RFC 3977 defines no UDP transport for NNTP/NNSP, which is conventionally carried over TCP

Other/unofficial uses

none identified; no vendor docs, forum threads, or community sightings tie any software to UDP transport on this port as of an August 2026 search [Unknown]

Common software

none confirmed for the UDP transport specifically; historical Usenet transit daemons (e.g. INN) run over TCP, not UDP [Unknown]

Security implications

no CVE recorded in the NVD as of 2026-08; auditmypc.com verdict "Virus / Trojan: No" (negative finding only); no confirmed real UDP deployment found

Typically seen on

no confirmed modern deployments; if legitimate NNTP/NNSP peering exists at all today it is expected on the TCP side [Unknown]

Analyst note

A responsive 433/udp is unusual — NNSP is conventionally a TCP service and no confirmed software generates genuine UDP traffic here — treat it as anomalous and worth investigating rather than assumed benign Usenet peering. [Likely] — synthesized from the registry and prevalence findings above