45
Summary
- // if you see it open
- Legacy ARPANET-era assignment that was never widely deployed; no modern software uses port 45 for its original purpose. No documented malware specifically uses 45/tcp and no notable scanning or exploitation population is reported in publicly available threat intelligence (reviewed through 2024–2025). A host unexpectedly listening on 45/tcp is anomalous and warrants investigation. (single-source / absence-of-evidence — Likely)
- // analyst note
- A vestigial RFC 759 MPM assignment. Treat an open 45/tcp as anomalous (decoy, backdoor, or misconfiguration) rather than an expected service; do not confuse with Apache's MPM.
About port 45/tcp.
Port 45/tcp is registered with IANA as mpm with the description "Message Processing Module [recv]" (dual-registered on TCP and UDP); the assignee and reference fields on this row are both blank. The protocol behind it is RFC 759, the "Internet Message Protocol" (Jonathan B. Postel, August 1980), an early ARPANET-era internetwork message (email-like) system in which Message Processing Modules exchanged messages by establishing a full-duplex TCP connection. RFC 759 states plainly that "the default port for the MPM is 45 (55 octal)," which is the source of this assignment, and the "[recv]" suffix marks port 45 as the receive side of an MPM pair — its companion, port 46/tcp mpm-snd ("MPM [default send]"), carries [Jon_Postel] as its registered assignee, and port 44/tcp mpm-flags ("MPM FLAGS Protocol") rounds out the small MPM cluster. RFC 759 is classified Historic by the IETF; the IANA reference field for port 45 is blank, so no RFC is cited in the registry itself. The protocol was never widely deployed and no modern software uses port 45 for its originally assigned purpose. A frequent third-party claim associates port 45 with the Apache HTTP Server's Multi-Processing Module (also abbreviated "MPM") — that is a naming coincidence only: Apache's MPM is an internal process model and does not listen on port 45. For an analyst, port 45 is best read as a vestigial ARPANET-era assignment: there is no documented malware that specifically uses it and no notable scanning population, so a host unexpectedly listening on 45/tcp is anomalous and worth investigating rather than an expected service.
- IANA assignment
mpm— "Message Processing Module [recv]"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 45/tcp + 45/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (CSV lines 99–100)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 45/tcp ≈ 0.00005 (very low — roughly 5 in 100,000 scanned hosts in the nmap-services sample); the paired 45/udp row is far higher at ≈ 0.000741, so essentially all observed activity on this port number sits on the UDP side [Confirmed] — nmap-services dataset. The figure records scan-observed openness on the port number, not confirmed RFC 759 MPM traffic [Confirmed]
- Registration / modification dates
- Unknown — IANA does not publish port registration dates; the defining specification RFC 759 was published August 1980 [Unknown]
- Related ports
- 44 (mpm-flags), 46 (mpm-snd); the broader small-services/ARPANET-legacy cluster
Primary use
receive-side port for a Message Processing Module under RFC 759 (Internet Message Protocol, Postel, Aug 1980); "the default port for the MPM is 45"
Protocol status
RFC 759 is classified Historic by the IETF; no successor RFC
Other/unofficial uses
none for the registered purpose; the "port 45 = Apache MPM" association seen on some port-reference sites is a naming coincidence (Apache MPM is an internal process model, not a port-45 listener)
Security implications
legacy ARPANET-era assignment never widely deployed; no documented malware specific to 45/tcp; no notable scanning/exploitation population reported in public threat intel reviewed through 2024–2025; a live listener would be anomalous
Typically seen on
effectively never seen in modern environments; an open 45 is an anomaly worth investigating
- Companion ports
- 44/tcp
mpm-flags("MPM FLAGS Protocol") and 46/tcpmpm-snd("MPM [default send]", assignee[Jon_Postel]) form the MPM cluster [Confirmed] — IANA registry (CSV lines 97–102) - Analyst note
- A vestigial RFC 759 MPM assignment. Treat an open 45/tcp as anomalous (decoy, backdoor, or misconfiguration) rather than an expected service; do not confuse with Apache's MPM.
About port 45/udp.
Port 45/udp is registered with IANA as mpm with the description "Message Processing Module [recv]" (dual-registered on TCP and UDP, identical service name and description on both rows); the assignee and reference fields on this row are both blank. The name comes from RFC 759, the "Internet Message Protocol" (Jonathan B. Postel, ISI, August 1980), an early ARPANET-era internetwork message (email-like) system in which Message Processing Modules (MPMs) on different hosts relayed messages between interconnected networks. RFC 759 states that "the default port for the MPM is 45 (55 octal)," which is the source of this assignment, and the "[recv]" suffix marks port 45 as the receive side of an MPM pair — its companion, port 46/udp mpm-snd ("MPM [default send]", registered assignee [Jon_Postel]), is the send side, and port 44/udp mpm-flags ("MPM FLAGS Protocol") rounds out the small MPM cluster. One honest caveat specific to the UDP row: RFC 759 describes MPM-to-MPM exchange over a reliable, full-duplex connection (TCP-style transport); the UDP registration on port 45 mirrors the TCP one by IANA convention but is not separately elaborated as a datagram protocol anywhere in the RFC text. RFC 759 is classified Historic by the IETF, the protocol was never widely deployed, and no modern software is known to bind 45/udp for its originally assigned purpose. The IANA reference field for port 45 is blank, so no RFC is cited in the registry itself; third-party databases that print "RFC 759" beside the entry are reproducing the associated historic RFC, not a value IANA records. A recurring third-party claim associating port 45 with the Apache HTTP Server's Multi-Processing Module (also abbreviated "MPM") is a naming coincidence only — Apache's MPM is an internal process model and does not listen on port 45. For an analyst, port 45/udp is best read as a vestigial ARPANET-era assignment: there is no documented malware that specifically uses it and no notable scanning population, so a host unexpectedly responding on 45/udp is anomalous and worth investigating rather than an expected service.
- IANA assignment
mpm— "Message Processing Module [recv]"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 45/tcp + 45/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (registries/service-names-port-numbers.csv line 100:mpm,45,udp,Message Processing Module [recv],,,,,,,,)- Range class
- well-known / System Ports (0–1023) [Confirmed] — IANA registry
- IANA reference
- blank in the registry; "RFC 759" associations in third-party databases reproduce the associated historic RFC, not an IANA-recorded reference [Confirmed] — IANA registry; datatracker.ietf.org/doc/html/rfc759
- Prevalence
- nmap-services observed open-frequency 45/udp ≈ 0.000741 — very low (roughly 7 in 10,000 scanned hosts in the nmap-services sample); the paired 45/tcp row is far rarer at ≈ 0.00005, so essentially all observed activity on this port number sits on the UDP side [Confirmed] — nmap-services dataset
- Registration / modification dates
- Unknown — IANA does not publish port registration dates; the defining specification RFC 759 was published August 1980 (a publication date, not an IANA registration date) [Unknown]
- Related ports
- 45/tcp (identical mpm registration); 44 (mpm-flags), 46 (mpm-snd); the broader small-services / ARPANET-legacy cluster
Primary use
receive-side port for a Message Processing Module under RFC 759 (Internet Message Protocol, Postel, Aug 1980); "the default port for the MPM is 45 (55 octal)"
Protocol status
RFC 759 is classified Historic by the IETF; no successor RFC
Other/unofficial uses
none for the registered purpose; the "port 45 = Apache MPM" association seen on some port-reference sites is a naming coincidence (Apache MPM is an internal process model, not a port-45 listener)
Security implications
legacy ARPANET-era assignment never widely deployed; no documented malware specific to 45/udp (auditmypc.com explicitly marks the registered protocol "Virus/Trojan: No"); no notable scanning/exploitation population reported in public sources reviewed through 2024–2025; a live listener would be anomalous
Typically seen on
effectively never seen in modern environments; an open 45/udp is an anomaly worth investigating
- UDP-specific caveat
- RFC 759 describes MPM exchange over a reliable full-duplex (TCP-style) connection; the UDP registration mirrors the TCP one by IANA convention and is not separately elaborated as a datagram protocol in the RFC [Confirmed] — RFC 759 (datatracker.ietf.org/doc/html/rfc759)
- Companion ports
- 44/udp
mpm-flags("MPM FLAGS Protocol") and 46/udpmpm-snd("MPM [default send]", assignee[Jon_Postel]) form the MPM cluster [Confirmed] — IANA registry (CSV lines 97–102) - Analyst note
- A vestigial RFC 759 MPM assignment. Treat an open 45/udp as anomalous (decoy, backdoor, or misconfiguration) rather than an expected service; do not confuse with Apache's MPM, and remember RFC 759 frames MPM transport as TCP-style.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| mpm | UDP | Message Processing Module [recv] | 0.07% |
| mpm | TCP | Message Processing Module [recv] | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.