440
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — SGCP was superseded by MGCP within months of its 1998 draft and has no known surviving implementations or documented current software, so a listener on 440/tcp does not correspond to any expected legitimate service and should be treated as anomalous if observed.
- // analyst note
- An open port 440 is statistically rare (nmap-services ~0.006% tcp) and has no documented legitimate current use — treat as anomalous and worth investigating; do not assume VoIP/SGCP traffic without further evidence.
- // if you see it open
- SGCP was superseded by MGCP within months of its 1998 draft and has no known surviving implementations, so no current software is documented generating legitimate traffic on 440/tcp. No CVE or NVD record is associated with this port as of an August 2026 search, and auditmypc.com's TCP-440 page carries no virus/trojan verdict content. One low-quality aggregator (connected.app) claims without a working citation that trojans/malware have used this port for command and control; this is uncorroborated by any reputable source and is not treated as fact. Because no legitimate current use is documented, an open 440/tcp is anomalous and worth investigating if observed.
About port 440/tcp.
Port 440/tcp is IANA-registered for sgcp (Simple Gateway Control Protocol), an experimental VoIP call-control draft from 1998 that was superseded within months and has no known production implementations today. A listener on this port has no legitimate public-facing role, so it does not belong on the public internet.
SGCP was drafted by Mauricio Arango and Christian Huitema of Telcordia (formerly Bellcore) as a controller-to-gateway signaling protocol for early VoIP, published as IETF Internet-Drafts between May and July 1998. It defined how a call agent instructs a media gateway to create, modify, and delete connections between telephone circuits and IP endpoints. By around October 1998, SGCP merged with Level 3's competing IPDC proposal to become MGCP, standardized in RFC 2705, and SGCP itself never advanced to RFC status.
IANA's registry dual-registers port 440 as sgcp on both TCP and UDP, with assignee listed as [Marshall_Rose] and a blank reference field — consistent with a registration tied to an expired draft rather than a ratified RFC. No registration date is recorded in the registry.
Because SGCP was overtaken by MGCP before any documented production deployment, no current software is known to generate legitimate traffic on 440/tcp. nmap-services open-frequency data puts 440/tcp at roughly 0.006% and 440/udp at roughly 0.08% — both rarely-open readings consistent with a dormant, largely unused registration rather than an active service port.
- IANA assignment
sgcp— "sgcp"; reference (blank — no RFC cited in IANA registry); assignee [Marshall_Rose]; dual-registered 440/tcp + 440/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry sgcp 440/tcp, sgcp 440/udp- Range class
- well-known (0–1023); source artifact labels this the "system" range [Confirmed] — this site's own tooling (port 440 entry)
- Prevalence
- nmap-services open-frequency 440/tcp ≈ 0.000063 (~0.006%); 440/udp ≈ 0.000807 (~0.08%) [Confirmed] — this site's own tooling (port 440 entry)
- Related ports
- MGCP successor ports 2427/tcp+udp (
mgcp-gateway) and 2727/tcp+udp (mgcp-callagent), both also assigned to Christian Huitema [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mgcp-gateway 2427/tcp, mgcp-callagent 2727/tcp
Primary use
Simple Gateway Control Protocol (SGCP) — an IETF Internet-Draft VoIP call-control protocol (a call agent instructs a media gateway to create/modify/delete connections between telephone circuits and IP endpoints); drafted by Mauricio Arango and Christian Huitema, Telcordia, May–July 1998; never reached RFC status
Other/unofficial uses
none documented; SGCP merged into Level 3's competing IPDC proposal around October 1998 to form MGCP (RFC 2705 and successors), which superseded it entirely
Security implications
no known surviving SGCP implementations or documented current software on this port; no CVE/NVD record as of an August 2026 search; one uncorroborated aggregator claim of trojan/C2 use is not treated as fact
Typically seen on
no known current systems — SGCP had no documented production deployment before being superseded; treat an open 440/tcp as anomalous if observed [Unknown]
- Analyst note
- An open port 440 is statistically rare (nmap-services ~0.006% tcp) and has no documented legitimate current use — treat as anomalous and worth investigating; do not assume VoIP/SGCP traffic without further evidence.
About port 440/udp.
Port 440/udp is registered to sgcp (Simple Gateway Control Protocol), a short-lived 1998 VoIP media-gateway control protocol that was superseded within months of its introduction; no current, actively deployed software has been found using this port, so a listener here is unexpected and worth treating as anomalous rather than routine traffic.
IANA lists port 440 as sgcp on both TCP and UDP, assigned to Marshall Rose, with no RFC or reference recorded and no registration or modification date documented in the registry. The two transports (440/tcp and 440/udp) share the identical sgcp registry entry.
SGCP was proposed in 1998 by Bellcore/Telcordia authors Arango and Huitema as an early call-control protocol for VoIP media gateways. It merged with a competing proposal that same October to form MGCP (Media Gateway Control Protocol), which superseded it; later MGCP deployments commonly used UDP ports 2427 and 2727 instead of 440.
No current, actively deployed software or service was found using UDP 440 for its original SGCP purpose as of an August 2026 search. Generic port-directory aggregator sites return only templated or inaccessible content for this port, with no specific application named in any of them.
- IANA assignment
sgcp— registry lists no expanded description beyond the short name "sgcp"; reference (blank — no RFC cited); assignee Marshall Rose; dual-registered 440/tcp + 440/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry sgcp 440/udp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- port-data.json (nmap-services-derived) open-frequency 440/udp ≈ 0.000807 (~0.08%); 440/tcp ≈ 0.000063 (~0.006%) [Confirmed] — this site's own tooling
- Related ports
- 440/tcp (same sgcp dual registration); MGCP successor protocol commonly on UDP 2427 / UDP 2727 [Likely] — the IANA Service Name and Transport Protocol Port Number Registry sgcp 440/tcp, https://en.wikipedia.org/wiki/Media_Gateway_Control_Protocol
Primary use
SGCP (Simple Gateway Control Protocol), a short-lived 1998 VoIP media-gateway control protocol proposal (Bellcore/Telcordia, Arango & Huitema) that merged into MGCP in October 1998 and was superseded; no current active use documented
Other/unofficial uses
none documented; no software or service reported using this port as of an August 2026 search across port-aggregator sites (connected.app, speedguide.net, ports.my-addr.com)
Security implications
no CVE or named malware family documented for 440/udp as of an August 2026 search; a single aggregator (connected.app) makes an unattributed, unsourced trojan/C2 claim not corroborated elsewhere
Typically seen on
no current deployments documented as of an August 2026 search; a historical 1998 protocol registration only [Unknown]
- Analyst note
- SGCP was superseded within months of its 1998 proposal and no current software is documented using UDP 440 — an open listener here is unexpected and worth investigating rather than assumed to be routine traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| sgcp | UDP | — | 0.08% |
| sgcp | TCP | — | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.