439

Port 439/tcp is registered to the IANA service name dasp, but the registry supplies only a bare label with no RFC, no protocol specification, and no software confirmed running on it as of an August 2026 search; an open 439/tcp therefore has no established legitimate reason to be reachable from the public internet and should be treated as anomalous rather than routine traffic.

The IANA Service Names and Port Numbers registry lists dasp on both 439/tcp and 439/udp, with the description field identical to the service name and no further elaboration. The Reference column is blank — no RFC or specification document is cited — while the Assignee and Contact fields both name Thomas Obermair, the individual who registered the name with IANA. No registration or modification date is recorded.

No RFC, vendor page, or software repository was found describing what dasp does or confirming real-world protocol traffic that conforms to it. A web-search AI-generated summary surfaced an unsourced claim that port 439 carries Microsoft DHCP client-server communication; this could not be traced to a primary source and conflicts with DHCP's actual well-known ports (67/68), so it is not recorded as verified here.

SANS Internet Storm Center's port-439 activity page showed only sparse background scanning noise — one source IP with one hit on the most recent day, another with ten hits the day before — under an overall "green" (low) threat-level indicator, with no CVE or comment entries tied to the port. No malware or trojan association is documented; auditmypc.com's disclaimer about historical virus flags is templated boilerplate appearing across its port pages, not a finding specific to 439.

IANA assignment

dasp — description "dasp" (identical to the service name, no elaboration); Reference column blank; Assignee/Contact "Thomas Obermair"; dual-registered 439/tcp + 439/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry dasp 439/tcp; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=439

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 439/tcp = 0.000013; 439/udp ≈ 0.000412 [Confirmed] — this site's own tooling

Related ports

none documented by IANA — dasp sits among a run of individually-registered, undocumented 1990s-era service stubs (435–441) with no naming or functional relationship to neighboring entries [Unknown] — the IANA Service Name and Transport Protocol Port Number Registry

Primary use

Unknown beyond the bare IANA label — no RFC, protocol specification, or software implementation confirms what dasp does

Other/unofficial uses

none found in vendor docs, blogs, forums, or software repositories as of an August 2026 search; an uncorroborated web-search claim linking the port to Microsoft DHCP conflicts with DHCP's standard ports (67/68) and is not recorded as verified [Unknown]

Security implications

no CVE recorded and no malware/trojan association documented as of an August 2026 search; SANS ISC shows only sparse background scan noise with a green/low threat rating

Typically seen on

Unknown as of an August 2026 search — no vendor or software attribution found [Unknown]

Analyst note

treat an open 439/tcp as anomalous/unrecognized traffic rather than assume a legitimate service; no documented protocol, vendor, or software implementation exists for dasp.

Port 439/udp carries dasp, IANA's registered service name for the port — the registry's own description field is just the bare string "dasp" with no expansion supplied. Vendor documentation identifies the underlying protocol as DASP, the Distributed Authenticated Service Protocol, and it should stay limited to authenticated, known peers rather than be opened to arbitrary public internet traffic, since it is built around per-session cryptographic authentication rather than serving anonymous incoming connections.

IANA dual-registers the name on both TCP and UDP, with Thomas Obermair as assignee and a blank Reference field — no RFC defines the protocol, and no registration or modification date is recorded in the registry for this row.

Vendor documentation from Germany-based Inlab Networks describes DASP as a UDP protocol for bidirectional, authenticated, and optionally encrypted communication between two endpoints, supporting peer discovery through a third-party registry when a peer's location isn't known in advance, mid-session IPv4/IPv6 switching, and an alternative fragmentation scheme to standard UDP/IP; it authenticates with SHA-256 and encrypts with ChaCha20 or AES-256-CTR.

Inlab's RBridge NAT-traversal and tunneling product, and its related EtherTunnel offering, are the only named software found using DASP on UDP port 439; the IANA assignee is consistent with Inlab's authorship of the protocol's own documentation, though the registry row itself names no product. No other application, game, or P2P client was found using this port as of an August 2026 search.

SANS Internet Storm Center's port-439 activity data shows only sparse background scanning — single-digit to low-double-digit source-IP counts per day — with no CVE references or user-submitted abuse notes attached, and no malware or Trojan family is documented against 439/udp as of an August 2026 search.

IANA assignment

dasp — "dasp"; reference (blank — no RFC cited in IANA registry); assignee Thomas Obermair; dual-registered 439/tcp + 439/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry dasp 439/udp

Range class

well-known (System Ports, 0–1023) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Prevalence

nmap-services open-frequency 439/udp = 0.000412 (~0.041%); 439/tcp = 0.000013 (~0.001%) [Confirmed] — this site's own tooling

Related ports

439/tcp (same dasp service name, dual-registered) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry dasp 439/tcp

Primary use

DASP (Distributed Authenticated Service Protocol) per vendor (Inlab Networks) documentation — a UDP protocol for bidirectional, authenticated, optionally encrypted peer communication, with third-party-registry peer discovery and mid-session IPv4/IPv6 switching; not an IANA/RFC-defined protocol

Other/unofficial uses

none found beyond Inlab Networks' RBridge and EtherTunnel products

Security implications

no CVE or malware family verifiably tied to 439/udp; auditmypc.com's UDP port 439 page did not return readable content in this search, so no verdict is cited from it

Typically seen on

Inlab Networks NAT-traversal/tunneling deployments (RBridge, EtherTunnel)

Analyst note

An open 439/udp most plausibly reflects Inlab Networks DASP-based tunneling traffic (RBridge/EtherTunnel); with no RFC or IANA-confirmed protocol behind the bare registration, verify the actual application before assuming routine traffic.