444

Port 444/tcp is registered with IANA as snpp with the description "Simple Network Paging Protocol," blank assignee and dates, and a reference of [RFC1568] — one of only two entries in its batch whose IANA Reference field is not blank (dual-registered on TCP and UDP). The registered purpose is submitting alphanumeric and numeric messages to radio pager networks over TCP/IP. SNPP was authored by R. Allen Gwinn (Southern Methodist University) across RFC 1568 (v1(b), January 1994), RFC 1645 (v2, July 1994), and RFC 1861 (v3 Two-Way Enhanced, October 1995); it is a simple SMTP-like text protocol in which a client opens TCP 444 and issues PAGE (the recipient pager ID), MESS (message text), and SEND, receiving immediate status replies such as "250 Page Sent," with the server translating to TAP/IXO for the paging terminal. It is largely obsolete with the decline of pagers, though some healthcare and critical-infrastructure environments persist. The crucial modern reality, however, is registered-versus-de-facto: port 444 today is overwhelmingly seen as a security-appliance web or VPN port rather than a pager gateway — SonicWall documents using 444 as an alternate HTTPS management port, and Sophos firewalls/UTM use 444x ports for SSL-VPN, the user/admin portals, and web admin — and it is also a common generic alternate-HTTPS port. The IANA reference field is [RFC1568]. Security-wise SNPP itself is plaintext and obsolete (v1 had no auth; v2 added an optional LOGIN, often unused), but the more important consideration is reconnaissance: an open 444 is far more likely to be a SonicWall/Sophos management or SSL-VPN interface — a fingerprintable, high-value target — than a paging system. For an analyst, an open 444 should be treated as probably a SonicWall/Sophos security-appliance web or VPN interface; confirm via the TLS banner or certificate before assuming SNPP, and treat any exposed admin interface as the priority.

IANA assignment

snpp — "Simple Network Paging Protocol"; reference [RFC1568]; assignee blank; dual-registered 444/tcp + 444/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

moderately common; nmap-services open-frequency ~0.004466 (de-facto), driven by security appliances [Well-established] — nmap-services file

Related ports

443 (HTTPS); SonicWall/Sophos management/VPN ports

Primary use (registered)

submitting messages to radio pager networks (SNPP, RFC 1568/1645/1861)

Other/unofficial uses (de-facto, dominant)

SonicWall alternate-HTTPS management; Sophos SSL-VPN/portal/web-admin; generic alternate HTTPS

Security implications

SNPP plaintext/obsolete; the key consideration is recon — an open 444 is more likely a SonicWall/Sophos admin/VPN interface (fingerprintable, high-value target) than a pager gateway [Well-established/Threat-reported]

Typically seen on

SonicWall/Sophos appliances (de-facto); rarely legacy pager gateways (e.g. NotePage PageGate)

Analyst note

An open 444 is probably a SonicWall/Sophos security-appliance web/VPN interface — confirm via TLS banner/cert before assuming SNPP, and treat an exposed admin interface as the priority.

Port 444/udp is IANA-registered as snpp (Simple Network Paging Protocol), but the protocol is TCP-session-based with no documented UDP deployment, so this port's exposure cannot be confidently classified as internal-only or public-facing from the registration alone. What little concrete signal exists points away from paging entirely, toward routine internet noise and one hedged, unofficial de-facto use.

SNPP is an SMTP-like protocol for submitting alphanumeric messages to radio pager networks, authored by R. Allen Gwinn across RFC 1568 (v1, 1994), RFC 1645 (v2, 1994), and RFC 1861 (v3, 1995); a client opens a session and sends PAGE/MESS/SEND commands, getting a status reply like '250 Page Sent.' IANA dual-registers the service on 444/tcp and 444/udp with reference [RFC1568] and a blank assignee, but implementations run over TCP — the UDP side has no documented deployment.

Measured open-frequency in the nmap-services dataset puts 444/udp at about 0.000873 — roughly five times rarer than 444/tcp's own modest 0.004466 — consistent with a service that is legacy on its primary transport and essentially unseen on UDP. Pager infrastructure keeps shrinking industry-wide, so this figure is unlikely to grow.

The concrete de-facto signal for this port is unrelated to paging: community reports — a SANS ISC user comment, the game's own GitHub issue tracker, and third-party server-IP listings — describe the multiplayer browser game Slither.io using UDP/TCP 444 as a default game-server port. This sourcing is hedged and unofficial, not vendor- or IANA-confirmed. SANS ISC's live port-444 dashboard also logs routine internet scanning — thousands of daily probe attempts from rotating source IPs — not SNPP-specific.

IANA assignment

snpp — "Simple Network Paging Protocol"; reference [RFC1568]; assignee blank; dual-registered 444/tcp + 444/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry snpp 444/udp

Range class

well-known (0–1023) [Confirmed] — port number falls within IANA's well-known range definition (0–1023)

Prevalence

nmap-services open-frequency 444/udp ≈ 0.000873 (444/tcp ≈ 0.004466 for comparison) [Confirmed] — this site's own tooling (built from nmap-services)

Related ports

444/tcp (dual-registered SNPP pair; TCP side dominated by SonicWall/Sophos de-facto use) [Confirmed] — /port/444/ (DONE entry)

Primary use (registered)

submitting alphanumeric/numeric pager messages via SNPP (RFC 1568/1645/1861); the protocol is TCP-session-based and the UDP registration has no documented implementation

Other/unofficial uses (de-facto, community-reported)

the multiplayer browser game Slither.io reportedly uses UDP/TCP 444 as a default game-server port

Security implications

SNPP is plaintext/largely obsolete; real-world signal on UDP is dominated by routine internet scanning and the unrelated community-reported gaming use rather than paging traffic; no malware association confirmed by a primary source

Typically seen on

rare legacy paging gateways; possibly public game servers per unofficial community reports; general internet background-scan targets

Analyst note

Do not assume paging if UDP 444 is seen open — the registered protocol has no documented UDP deployment; check for a game-server process (e.g. Slither.io-style traffic) or treat it as generic scan-target noise before further triage.

[Likely] — synthesis of registry and community-sourcing findings above