468
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — Photuris was an experimental 1990s IPsec key-management proposal superseded by ISAKMP/IKE and never saw meaningful production deployment, so a host answering on 468/tcp today is unusual and warrants investigation rather than expected key-management traffic.
- // analyst note
- an open 468/tcp is unusual — Photuris never achieved real-world deployment, so investigate rather than assume routine key-management traffic.
- // if you see it open
- No CVE is recorded in the NVD as of an August 2026 search tied to 468/tcp or Photuris. AuditMyPC's generic per-port template carries a 'Virus/Trojan: No' verdict for this port class; that source is cited only for the negative finding, never as evidence of an association. Photuris never reached production deployment and was superseded by ISAKMP/IKE, so a host answering on 468/tcp is anomalous and worth investigating.
About port 468/tcp.
Port 468/tcp is registered to photuris, an experimental early-1990s protocol for negotiating IPsec session keys; it has no legitimate reason to be reachable from the public internet, and the available evidence indicates it is essentially never seen open in practice.
IANA dual-registers 468 on TCP and UDP under the service name photuris, with a description field that reads verbatim "proturis" — an apparent typo baked into the registry's own text, not introduced here — assignee Bill_Simpson_2, and blank Reference and Registration Date columns.
The protocol comes from RFC 2522 (Photuris: Session-Key Management Protocol) and RFC 2523 (Extended Schemes and Attributes), both from the mid-1990s Photuris IPsec key-exchange design effort. It let two hosts derive short-lived IPsec session keys from pre-shared long-term secrets, using a stateless cookie exchange to resist flooding and spoofing — the same problem space that ISAKMP/IKE later solved and effectively replaced.
No vendor documentation, blog post, or forum thread was found describing production software that generates traffic on 468/tcp today; the design appears to have stayed experimental and was superseded before any wide deployment. this site's own tooling records an open-frequency of 0 for 468/tcp (a real sampled reading, not "not researched") and about 0.00056 for 468/udp — both effectively negligible.
- IANA assignment
photuris— description literally "proturis" (verbatim registry text); reference (blank — no RFC cited in the registry Reference column); assignee Bill_Simpson_2; dual-registered 468/tcp + 468/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (photuris 468/tcp), https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- this site's own tooling open-frequency 468/tcp = 0 (sampled, not observed open); 468/udp ≈ 0.00056 (negligible) [Confirmed] — this site's own tooling
- Related ports
- 500/udp (ISAKMP/IKE, the protocol that effectively superseded Photuris) [Likely]
Primary use
experimental IPsec session-key management protocol (RFC 2522, RFC 2523); establishes short-lived IPsec keys via a stateless cookie exchange resistant to flooding/spoofing, effectively superseded by ISAKMP/IKE
Other/unofficial uses
none found; no vendor software confirmed generating traffic on this port as of an August 2026 search
Security implications
no CVE recorded in the NVD as of an August 2026 search; AuditMyPC's generic template carries a "Virus/Trojan: No" verdict for this port class (negative finding only)
Typically seen on
no confirmed production deployments found; an open instance would be an anomaly [Unknown]
- Analyst note
- an open 468/tcp is unusual — Photuris never achieved real-world deployment, so investigate rather than assume routine key-management traffic.
About port 468/udp.
Port 468/udp carries Photuris, an experimental IPsec key-management protocol; it saw no meaningful real-world deployment, so an open 468/udp today is anomalous and unexpected. IANA's Service Name and Transport Protocol Port Number Registry lists it as photuris, dual-registered on 468/tcp and 468/udp to assignee Bill_Simpson_2, with a blank Reference field and blank Registration/Modification Date fields.
Photuris is defined in RFC 2522 (core protocol) and extended in RFC 2523 (extended schemes/attributes), both published in 1999 on the historic/experimental track. It negotiates session keys for the IPsec AH and ESP protocols: the Initiator sends messages to UDP destination port 468, and the Responder swaps source and destination ports to reply.
Photuris was an early alternative to what became IKE/ISAKMP for IPsec key management, and IKE won out before Photuris saw broad deployment. No current, actively maintained software or vendor product implementing Photuris turned up in an August 2026 search, and no community sightings of unrelated software repurposing 468/udp (vendor docs, blogs, forum threads) were found either.
Worth noting: the IANA registry's Description field for this entry literally reads "proturis" — a typo/garble of "photuris" that has persisted in the live registry row rather than a distinct service name. It is reported here as-is, not corrected.
- IANA assignment
photuris— description field literally reads "proturis" (garbled form of "photuris," reported as-is); assignee/contact Bill_Simpson_2; dual-registered 468/tcp + 468/udp; Reference field blank [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry photuris 468/udp- Range class
- system/well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry photuris 468/udp
- Prevalence
- nmap-services open-frequency 468/udp = 0.00056 (measured, sampled); 468/tcp = 0 (measured, sampled — not observed open in the corpus) [Confirmed] — this site's own tooling
- Related ports
- 500/udp (ISAKMP/IKE, the protocol that superseded Photuris for IPsec key management)
Primary use
Photuris Session-Key Management Protocol — negotiates session keys for IPsec AH/ESP; Initiator sends to UDP port 468, Responder replies with swapped ports
Other/unofficial uses
none identified; no current software or community sightings of repurposed traffic found as of an August 2026 search [Unknown]
Security implications
no CVE recorded in NVD as of August 2026; no malware association found — auditmypc.com's udp-port-468 page carries the site's generic per-port template for this port class, not a port-specific verdict; essentially unused in the wild since IKE superseded Photuris before broad deployment
Typically seen on
no known modern deployments; would appear only on legacy/experimental IPsec test setups if at all [Unknown]
- Analyst note
- Registration/Modification Date fields are blank in the live IANA CSV row — no date is fabricated or assumed for this assignment.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| photuris | UDP | — | 0.06% |
| photuris | TCP | Photuris Key Management | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.