46
Summary
- // if you see it open
- No expected legitimate listener — the registered MPM service is obsolete and unused. Port 46 is absent from Shodan's default scan set (the published list skips from 43 to 49). Low-trust port databases record no malware or trojan association (auditmypc.com: 'Virus / Trojan: No'). Standard firewall hygiene: block unless a specific internal use is documented. Any open port 46/tcp on a modern host is anomalous and should be investigated as a possible decoy or backdoor.
- // analyst note
- The registered service is obsolete and effectively unused; treat any open port 46/tcp as anomalous and investigate (possible decoy or backdoor) rather than assuming a legitimate service. Note RFC 759 names port 45, not 46 — the "default send" role is a registry assignment from the MPM cluster.
About port 46/tcp.
Port 46/tcp is registered with IANA as mpm-snd with the description "MPM [default send]," assignee and contact Jon Postel, and a blank reference field (dual-registered on TCP and UDP). The name belongs to the Message Processing Module (MPM), an experimental early-ARPA internetwork mail-transfer architecture described in RFC 759 (J. Postel, August 1980) — the conceptual predecessor of modern SMTP mail transfer agents, designed to route and deliver messages across ARPA internet hosts. MPM occupies a small cluster of adjacent well-known ports: port 44 (mpm-flags, "MPM FLAGS Protocol") carries a signaling role, port 45 (mpm, "Message Processing Module [recv]") is the data/receive port, and port 46 is registered as the "default send" companion. It is worth being precise about provenance: RFC 759 names port 45 as the MPM default — section 5.1 states the port "takes the default value 45 (55 octal)" and section 3.6 repeats "the default port for the MPM is 45 (55 octal)" — but it does not enumerate port 46 by number, and the document makes no explicit "send"/"receive" port distinction. The mpm-snd label and its "default send" role are therefore an IANA registry assignment associated with the MPM port cluster, not a literal RFC 759 citation; the registry lists no RFC reference for port 46. The IANA reference field is blank, and the registry publishes no registration date — any third-party "date registered" value is a database artifact and none has been fabricated here. The MPM architecture was experimental, never widely deployed, and is obsolete; no known active software implements this service today, and no surviving documentation elaborates port 46's distinct "send" function. For an analyst the registered service is effectively irrelevant — the port has no expected legitimate listener on a modern host. Port 46 is also absent from Shodan's default scan set (the published list skips from 43 to 49), and low-trust port databases record no malware or trojan association for it (auditmypc.com lists "Virus / Trojan: No"). Because the originating protocol is obsolete and no legitimate service binds here, any open port 46/tcp listener on a modern host is anomalous and worth investigating as a possible decoy or backdoor rather than a normal service.
- IANA assignment
mpm-snd— "MPM [default send]"; reference (blank — no RFC cited in IANA registry); assignee/contact Jon Postel; dual-registered 46/tcp + 46/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 101–102)- Range class
- well-known (0–1023)
- IANA RFC reference
- none listed in the registry for
mpm-snd; RFC 759 names port 45 (not 46) and draws no send/receive distinction, so any attribution of "RFC 759" to port 46 is an inference from the MPM lineage, not an explicit IANA/RFC assignment [Confirmed] — IANA registry; RFC 759 §5.1, §3.6 - Prevalence
- Unknown — port 46 is absent from Shodan's default scan list (the published list jumps from 43 to 49, skipping 46); no authoritative open-frequency figure was verified [Likely] — Shodan default-port list (s0md3v gist)
- Related ports
- MPM cluster — 44/tcp (
mpm-flags, "MPM FLAGS Protocol"), 45/tcp (mpm, "Message Processing Module [recv]"); adjacent legacy assignments 42 (name/nameserver), 43 (nicname/whois) - Registration date
- Unknown — IANA does not publish registration dates for port assignments and no authoritative third-party date is available; none has been fabricated [Unknown]
Primary use
the "default send" companion port of the Message Processing Module (MPM), an experimental ARPA internetwork mail-transfer architecture; part of the MPM port cluster with the data/receive port 45 and the flags port 44 [Likely] — RFC 759 (J. Postel, Aug 1980) describes MPM and names port 45 as the default, but does not enumerate port 46 by number; the "send" role is an IANA registry assignment
Common software
Unknown — no known modern software binds to port 46/tcp; the MPM architecture (RFC 759, 1980) was experimental and never reached widespread adoption
Security implications
no expected legitimate listener; low-trust port databases record no malware/trojan association (auditmypc.com: "Virus / Trojan: No"). Standard hygiene: block unless a specific documented internal use exists; treat any open 46/tcp as anomalous
Typically seen on
no expected legitimate listener; an open port 46/tcp on a modern host is anomalous and possibly a decoy or backdoor
- Analyst note
- The registered service is obsolete and effectively unused; treat any open port 46/tcp as anomalous and investigate (possible decoy or backdoor) rather than assuming a legitimate service. Note RFC 759 names port 45, not 46 — the "default send" role is a registry assignment from the MPM cluster.
About port 46/udp.
Port 46/udp is registered with IANA as mpm-snd with the description "MPM [default send]," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP — 46/tcp carries the identical service name and description). It is the outbound "send" side of the Message Processing Module (MPM), an early-1980s ARPANET internetwork-mail experiment that predates SMTP. MPM occupies a small cluster of adjacent ports: 44 (mpm-flags), 45 (mpm, the default receive port), and 46 (mpm-snd, the default send port). The protocol itself is defined in RFC 759 (J. Postel, ISI, August 1980), which describes a store-and-forward message-processing system and designates port 45 as the canonical MPM default; RFC 759 does not explicitly name port 46 by number, so the 46/mpm-snd assignment is documented through the IANA registry and the RFC 1340 "Assigned Numbers" table (July 1992) rather than through a dedicated specification. The IANA reference field for this entry is blank, and IANA records neither a registration date nor a modification date for it. The protocol never saw deployment beyond experimental ARPANET nodes and was superseded entirely by SMTP (port 25/tcp); no modern software is known to bind 46/udp. For an analyst, the practical relevance is minimal: 46/udp does not appear among the busy ports tracked by Shodan, no CVEs or malware are specifically associated with it, and there is no legitimate active service to expect today. An observed packet on 46/udp is far more likely to be UDP scanner noise or port misuse than genuine MPM traffic, and the connectionless nature of UDP makes open-vs-closed state hard to confirm in the first place.
- IANA assignment
mpm-snd— "MPM [default send]"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 46/tcp + 46/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (CSV lines 101–102); corroborated by IANA xhtml search- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- negligible — 46/udp is absent from Shodan's analyzed top-ports list [Likely] — Shodan data-status ports table
- Related ports
- 25 (SMTP, the successor); 44/45 (the rest of the MPM cluster)
Primary use
outbound "send" port of the ARPANET Message Processing Module (MPM) mail system; RFC 759 defines MPM and names port 45 as the default, not 46 explicitly [Confirmed for the MPM/RFC 759 association; the 46-specific send role is from the IANA registry + RFC 1340, not RFC 759] — RFC 759, RFC 1340
Other/unofficial uses
none known — protocol obsolete, superseded by SMTP (25/tcp); no maintained software targets 46/udp
Security implications
effectively none from the assigned service (mpm-snd is a dead protocol with no active implementations); no port-specific CVE or malware/trojan association is documented; unexpected 46/udp traffic should be read as anomalous scan noise or misuse rather than legitimate MPM
Typically seen on
nothing in modern environments; would only ever have appeared on experimental early-1980s ARPANET MPM hosts
- Related MPM ports
- 44 (
mpm-flags), 45 (mpm, default receive) [Confirmed] — IANA registry - RFC 1340 cross-reference anomaly
- the early "Assigned Numbers" table lists mpm-snd alongside a citation to RFC 98, but RFC 98 (1971) is the Logger Protocol Proposal and is unrelated to MPM — an apparent transcription artifact in the early tables, not a real specification of port 46 [Likely] — RFC 1340, RFC 98
- Analyst note
- Treat an open or responsive 46/udp as scanner noise or port misuse, not as MPM. UDP open/closed state is unreliable to determine, and there is no legitimate modern service to expect here.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| mpm-snd | UDP | MPM [default send] | 0.05% |
| mpm-snd | TCP | MPM [default send] | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.