461
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No legitimate widely-deployed application or protocol specification is documented behind the datasurfsrv registration, and the port shows zero observed opens in the nmap-services sample, so a live 461/tcp listener warrants investigation rather than being assumed benign.
- // analyst note
- An open 461/tcp has no confirmed legitimate deployment behind it and a measured open-frequency of 0 in the nmap-services sample; treat it as anomalous and investigate rather than assume it is benign.
- // if you see it open
- No CVE was found in the NVD for 'datasurfsrv' as of an August 2026 search (keywordSearch, totalResults 0). No malware association is confirmed — internet-security.com records 'No Data Available' for 461/tcp (a sourced negative), and auditmypc.com's verdict line could not be retrieved. Juniper Threat Labs' DATASURFSRV application signature (Infrastructure/miscellaneous, risk rating 2) has a header citing the IANA 461 registration, but its actual detection port list is a different set (UDP 5246-5247/3386/3544, TCP 3386/434) and it names no specific software for port 461 itself. With zero observed opens in the nmap-services sample and no citable protocol spec, an open 461/tcp should be treated as anomalous and investigated.
About port 461/tcp.
Port 461/tcp is registered with IANA under the service name datasurfsrv, description "DataRampSrv"; no specific, widely-deployed application has been confirmed to use it, so an open 461/tcp is best treated as unusual rather than assumed to be a legitimate service meant to face the public internet.
The IANA registry entry is dual-registered on TCP and UDP under the same service name, but the assignee, contact, registration date, and reference/RFC fields are all blank. There is no citable protocol specification behind the assignment beyond the bare name and description strings.
Juniper Networks' Threat Labs application-signature database lists a DATASURFSRV signature (category Infrastructure/miscellaneous, risk rating 2) whose header cites the IANA registration on port 461 TCP/UDP, but whose actual detection port list is a different set entirely — published verbatim as UDP/5246-5247, UDP/3386, UDP/3544, TCP/3386, TCP/434 — and it supplies no further detail on what software generates traffic on port 461 itself.
Measured against the nmap-services corpus bundled with this repository (this site's own tooling), 461/tcp carries an open-frequency of exactly 0 — a real sampled reading, not an absence of data — while the paired 461/udp shows a low but nonzero 0.000379. Neither figure indicates deployment at meaningful scale.
- IANA assignment
datasurfsrv— "DataRampSrv"; reference (blank — no RFC/reference in the registry); assignee and contact blank; dual-registered 461/tcp + 461/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry datasurfsrv 461/tcp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 461/tcp = 0 (sampled, not observed open); 461/udp = 0.000379 [Confirmed] — this site's own tooling
- Related ports
- 461/udp (dual IANA registration, same service name) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry datasurfsrv 461/udp
Primary use
no publicly documented protocol specification or widely deployed application has been identified beyond the IANA name/description pair
Other/unofficial uses
none identified
Security implications
no CVE found in the NVD for datasurfsrv as of an August 2026 search; no confirmed malware association; internet-security.com records "No Data Available" for 461/tcp (sourced negative); Juniper Threat Labs' signature header cites the IANA 461 registration but its actual detection port list is a different set (UDP 5246-5247/3386/3544, TCP 3386/434) and adds no protocol detail for 461 itself
Typically seen on
Unknown — no confirmed typical host or software population identified [Unknown]
- Analyst note
- An open 461/tcp has no confirmed legitimate deployment behind it and a measured open-frequency of 0 in the nmap-services sample; treat it as anomalous and investigate rather than assume it is benign.
About port 461/udp.
Port 461/udp carries datasurfsrv, an IANA-registered service labeled "DataRampSrv"; no RFC, protocol specification, or corroborated real-world application was found for it, so whether it belongs on the public internet cannot be assessed and is recorded here as Unknown rather than guessed.
IANA's Service Name and Transport Protocol Port Number Registry lists 461 as datasurfsrv/"DataRampSrv" on both TCP and UDP, with blank Assignee, Reference, and registration/modification-date fields. Port 462 (datasurfsrvsec/"DataRampSrvSec") immediately follows in the same registry block and appears to be a security-enabled counterpart, though no protocol text ties the two together beyond adjacency and naming.
Two secondary sources mention the name without documenting live use. A Juniper Threat Labs application-signature page for DATASURFSRV cites the IANA port-461 registration, but its actual live-traffic detection fires on a different port set (5246-5247/udp, 3386/udp, 3544/udp, 3386/tcp, 434/tcp), not on 461 itself. The Indy (Internet Direct) Delphi/FreePascal networking library lists a generic constant, IdPORT_datasurfsrv = 461, taken straight from the IANA well-known-ports table — a constants-table entry, not evidence of active use.
No credible, independently corroborated sighting of software actually generating traffic on 461/udp turned up. Several port-lookup aggregators simply restate the IANA assignment, and one (scansearch.net) offers an unsourced narrative claiming use for "scientific data acquisition" and "industrial telemetry" that is not corroborated anywhere else and is treated as unverifiable filler, not a documented use case.
- IANA assignment
datasurfsrv— "DataRampSrv"; reference (blank — no RFC cited); assignee (blank); dual-registered 461/tcp + 461/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry datasurfsrv 461/udp- Range class
- well-known (0-1023) [Confirmed]
- Prevalence
- this site's own tooling records 461/udp open-frequency ≈0.000379 (~0.038%) and 461/tcp ≈0.000000 (not observed open in the scan corpus) [Confirmed] — this site's own tooling (built from nmap-services)
- Related ports
- 462/tcp + 462/udp (
datasurfsrvsec, "DataRampSrvSec," the adjacent registry entry) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry datasurfsrvsec 462/udp
Primary use
Unknown — the IANA registry supplies only the service name and description, with no RFC or protocol spec found elsewhere [Unknown]
Other/unofficial uses
none confirmed; a Juniper Threat Labs signature page cites the IANA registration but detects on a different port set, not 461 itself [Confirmed] — https://www.juniper.net/us/en/threatlabs/application-signatures/detail.DATASURFSRV.html; the Indy networking library carries a generic well-known-port constant sourced from the IANA list
Security implications
no CVE recorded in the NVD as of an August 2026 search; no malware/trojan association confirmed (auditmypc.com's verdict for this port could not be reliably retrieved this pass)
Typically seen on
Unknown — no corroborated real-world sightings of active software on this port were found [Unknown]
- Analyst note
- an open 461/udp is undocumented and statistically rare — worth investigating rather than assuming routine traffic, since no legitimate application has been corroborated using it.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| datasurfsrv | UDP | — | 0.04% |
| datasurfsrv | TCP | DataRampSrv | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.