4444

Port 4444/tcp is a registered-vs-de-facto split with a security twist: IANA registers it as krb524 with the description "KRB524," assignee B. Clifford Neuman, on both TCP and UDP, while the port's real-world fame is as the Metasploit Framework's default listener. The registered service, krb524, is the Kerberos 5-to-4 ticket translator; the IANA row even carries an unauthorized-use note recording that the port was assigned to krb524 while nv (a video service) used it without an assignment. The reference field is blank. The de-facto fame is far better known: Metasploit (created by H.D. Moore, first released 2003) conventionally uses TCP 4444 as the default LPORT for reverse shells and Meterpreter payloads — for example, windows/meterpreter/reverse_tcp defaults to LPORT 4444 — making it the attacker-controlled callback port that a compromised host connects out to. Meterpreter itself is an in-memory, dynamically extensible payload using a custom TLS-wrapped binary protocol. Because 4444 is the Metasploit default, a listener on it or traffic to it is one of the strongest single-port red flags for post-exploitation and C2, and EDR/IDS/IPS rules key on it heavily. It also has worm history: the Blaster (MSBlast) worm of August 2003 exploited the DCOM RPC vulnerability (MS03-026) and bound a SYSTEM-level shell to TCP 4444, with the SANS Internet Storm Center advising administrators to monitor TCP 4444 and UDP 69 (TFTP); estimates put roughly 188,000 machines infected within two days. Benign exceptions exist — Selenium WebDriver grids also default to 4444, and krb524 is legitimate — so context matters. For an analyst, an open or outbound-connecting 4444 on a host that is not a known pentest or Selenium node should be treated as likely post-exploitation until proven otherwise; pivot immediately to the listening process, its parent, and the peer IP.

IANA assignment

krb524 — "KRB524"; reference (blank — no RFC cited in IANA registry); assignee B. Clifford Neuman; registered for 4444/tcp and 4444/udp; IANA row notes unauthorized use by nv [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry (verified verbatim from live registry)

Range class

registered (1024–49151)

Prevalence

present in scans / nmap-services as a watched port (de-facto) [Well-established] — nmap-services file

Related ports

4445 (adjacent); contrast 31337/12345 (legacy backdoors); 69/udp (TFTP, Blaster staging)

De-facto use

Metasploit/Meterpreter default LPORT (NOT the IANA registration)

Primary use (de-facto)

attacker callback / reverse-shell listener for Metasploit payloads

Other/unofficial uses

krb524 (Kerberos 5→4 translator, legitimate); Selenium WebDriver grid default (benign) [Well-established]

Security implications

strong post-exploitation/C2 red flag (Metasploit default); EDR/IDS rules key on it; Blaster worm (Aug 2003, MS03-026) bound a SYSTEM shell to 4444 (~188k infected in 2 days); benign false positives (Selenium, krb524)

Typically seen on

attacker listeners, compromised hosts, pentest boxes; Selenium grids; rarely real krb524

Analyst note

An open or outbound-connecting 4444 on a non-pentest, non-Selenium host should be treated as likely post-exploitation until cleared. Pivot to process/parent/peer-IP immediately.

Port 4444/udp carries two distinct IANA registrations that share the number: krb524 ("KRB524"), assigned to B. Clifford Neuman, and nv-video ("NV Video default"), assigned to Ron Frederick. Both rows carry the same IANA assignment note — "krb524 assigned the port, nv used it without an assignment" — which records that nv-video occupied the port without a formal assignment of its own; the registry's reference, registration-date, and modification-date columns are all blank and are left as null here rather than inferred. krb524 is the Kerberos 5-to-4 ticket-translation service: the krb524d daemon converts Kerberos V5 tickets into V4 format so deployments that still spoke Kerberos v4 — notably some MIT Kerberos and OpenAFS sites bridging v4/v5 realms — could interoperate. That role is now effectively obsolete: major Kerberos distributions dropped Kerberos v4 support, and OpenAFS removed krb524d in its 1.7.x line, leaving the IANA holder a legacy entry. nv-video, the second (unauthorized) registrant, was a network-video/videoconferencing tool and is likewise defunct. For an analyst, the more important fact about 4444 is its security reputation: port 4444 (across both TCP and UDP) is heavily associated with the Metasploit Framework's default reverse-shell listener and with the 2003 MSBlast/Blaster worm, which used it as a backdoor port — the ISP-level blocking that followed actually disrupted legitimate krb524d traffic. SANS ISC continues to show automated scanning against 4444 from many distinct sources. So a responsive 4444/udp today is far more likely to be scanner noise, a Metasploit payload, or backdoor activity than a genuine krb524 or NV Video service, both of which are obsolete.

IANA assignment (1)

krb524 — "KRB524"; assignee/contact B. Clifford Neuman; reference (blank — no RFC cited in IANA registry); note "krb524 assigned the port, nv used it without an assignment"

[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached copy, krb524/udp row; also iana.org search=4444)

IANA assignment (2)

nv-video — "NV Video default"; assignee/contact Ron Frederick; reference (blank); same shared note (used the port without its own assignment) [Confirmed] — IANA registry (cached CSV nv-video/udp row; iana.org search=4444)

Range class

registered (1024–49151)

Status of registered services

legacy/deprecated — Kerberos v4 dropped by major distributions; OpenAFS removed krb524d in the 1.7.x line; NV Video defunct [Confirmed] — OpenAFS 1.7.32 release notes; SANS ISC

IANA reference

blank — IANA registry entry for krb524/4444 lists no RFC reference [Confirmed] — IANA registry (search=4444)

Related ports

Kerberos cluster (88/tcp+udp kerberos, 749 kerberos-adm, 464 kpasswd); 4444/tcp (same dual registrations + same malware association)

Primary use

krb524d — Kerberos 5→4 ticket translation for legacy v4/v5 interoperability (MIT Kerberos, OpenAFS bridging realms)

Other/unofficial uses

NV Video (historical videoconferencing, unauthorized registrant); 4444 broadly associated with eggdrop IRC bot and I2P HTTP proxy (I2P's 4444 is TCP, not UDP)

Security implications

4444 (TCP+UDP) is a high-attention port — Metasploit Framework default reverse-shell listener (TCP-dominant) and the 2003 MSBlast/Blaster worm backdoor; the resulting ISP blocking disrupted legitimate krb524d; ongoing automated scanning observed

Typically seen on

legacy v4/v5 Kerberos or OpenAFS bridge hosts (rare today); otherwise scanner noise, Metasploit payloads, or backdoor activity

Dual-registered on TCP

yes — parallel krb524/tcp and nv-video/tcp registrations exist for port 4444 [Confirmed] — IANA registry (cached CSV)

Analyst note

A responsive 4444/udp is statistically far more likely to be Metasploit/backdoor/scan activity than a genuine krb524 or NV Video service — both registered services are obsolete. Treat an unexpected open 4444 as a security signal, not a normal service.