47

Port 47/tcp carries no active IANA assignment: the IANA Service Name and Transport Protocol Port Number Registry lists it as "Reserved" with the annotation "This entry has been removed on 2017-05-18," and the same removal applies to 47/udp. The service name, assignee, registration date, and reference columns are all blank in the registry — no RFC is cited. The historical occupant of port 47 was ni-ftp, the Network Independent File Transfer Protocol, a file-transfer protocol from the UK's "Coloured Book" suite developed in the late 1970s/early 1980s and designed to run over several underlying transport services rather than TCP/IP alone. NI FTP ran on the UK academic networks SERCnet, SWUCN, and later JANET as those networks merged; the original IANA contact was Steve Kille of University College London. As the Internet protocol suite displaced the Coloured Book protocols in the UK through the early 1990s the protocol was retired, and IANA eventually removed the registration outright in 2017. For an analyst the most important fact about "47" is a namespace confusion: TCP/UDP port 47 must not be conflated with IP protocol number 47, which is GRE (Generic Routing Encapsulation, RFC 1701 / RFC 2784). GRE is an IP-layer protocol number — the encapsulation used by PPTP VPNs and visible in firewall logs as PROTO=47 — and is an entirely different namespace from a TCP or UDP port. Because no standard service uses port 47/tcp today, any traffic on it should be treated as anomalous (misconfiguration or probing) rather than a recognized service.

IANA assignment

Reserved — service name blank, "This entry has been removed on 2017-05-18"; reference blank (no RFC cited); assignee blank; dual-listed 47/tcp + 47/udp with identical Reserved status and removal note [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 103–104)

Modification date

2017-05-18 (entry removed) [Confirmed] — IANA registry CSV line 103

Registration date

blank in the registry [Confirmed] — IANA registry CSV line 103

Range class

well-known (0–1023)

Prevalence

nmap-services observed open-frequency 47/tcp ≈ 0.000075 (very low — under 1 in 10,000 scanned hosts, roughly 8 in 100,000, in the nmap-services sample); 47/udp is far higher at ≈ 0.001071, so what little activity carries this port number sits overwhelmingly on the UDP side [Confirmed] — nmap-services dataset (the dataset still carries the historical ni-ftp label for both rows, predating IANA's 2017 removal). The figure records scan-observed openness on the port number, not a surviving NI FTP service [Confirmed]

Related ports

the low/well-known range around it (46/tcp MPM, 48/tcp auditd, 49/tcp TACACS)

Common software / current use

Unknown — no currently maintained software is known to use 47/tcp; NI FTP has no surviving modern implementation identified in open sources [Unknown]

Security implications

no standard service uses 47/tcp, so traffic there is anomalous (misconfiguration or probing); scan-observed openness is very low (nmap-services ≈ 0.000075) and no significant 47/tcp-specific Shodan/Censys exposure reporting was found

Former service name

ni-ftp — Network Independent File Transfer Protocol, part of the UK Coloured Book suite; transport-agnostic; used on SERCnet, SWUCN, and JANET; original IANA contact Steve Kille (UCL); retired as TCP/IP displaced the Coloured Book protocols in the UK

[Confirmed] — IANA registry search; connected.app/ports/47; Wikipedia list of TCP/UDP port numbers

Disambiguation (critical)

TCP/UDP port 47 ≠ IP protocol 47. IP protocol 47 is GRE (Generic Routing Encapsulation, RFC 1701 / RFC 2784), an IP-layer protocol number used by PPTP VPNs and seen as PROTO=47 in firewall logs — a different namespace; the PPTP/firewall-bypass security context applies to IP protocol 47, not to TCP/UDP port 47

[Confirmed] — RFC 1701, RFC 2784; Ubiquiti community thread on PROTO=47

Analyst note

An open or active port 47/tcp has no recognized service behind it — investigate as anomalous; do not confuse it with GRE (IP protocol 47).

Port 47/udp currently has no service name in the IANA Service Name and Transport Protocol Port Number Registry: its description is "Reserved" with the note "This entry has been removed on 2017-05-18," and the reference field is blank. The same removal applies symmetrically to 47/tcp, so both transports were deregistered together on that date. Before the removal, port 47 was historically assigned to ni-ftp, the Network Independent File Transfer Protocol — a UK-origin file-transfer protocol specified by a committee of British organisations in 1979 and documented in IEN 99 (Internet Experiment Note 99, May 1979), not in any RFC. NI FTP used a two-phase model: a negotiation phase to agree file attributes, then a data-transfer phase with error control, flow management, and optional compression. It was deliberately designed for "network independence" to survive the move to X.25 networking and operated within the UK "Coloured Book" suite on JANET; Internet protocols displaced that suite from late 1991, after which NI FTP became obsolete. Note that port 47 must not be confused with GRE (Generic Routing Encapsulation), which is IP protocol number 47 — a different number space entirely; some secondary sources conflate the two. For an analyst, an unassigned well-known port like 47/udp has no expected legitimate service today, so unexpected traffic typically points to misconfiguration, scanning, or undocumented port reuse rather than a registered application. No CVEs, exploitation campaigns, or notable scanning activity specific to 47/udp were found in public sources as of mid-2026, and no current software is known to use it.

IANA assignment

no service name — description "Reserved"; assignment note "This entry has been removed on 2017-05-18"; reference (blank — no RFC cited in IANA registry); dual-registered 47/tcp + 47/udp, both removed 2017-05-18 [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; the IANA Service Name and Transport Protocol Port Number Registry line 104

Range class

well-known (0–1023) [Confirmed] — IANA registry

Prevalence

nmap-services observed open-frequency 47/udp ≈ 0.001071 — very low (roughly 1 in 1,000 sampled hosts), 326th of 5,615 UDP entries; the TCP sibling 47/tcp is ≈ 0.000075. Since IANA removed the assignment in 2017, whatever answers on those hosts is by definition not a registered service

[Likely] — nmap-services dataset

Related ports

contrast IP protocol 47 (GRE), a different number space frequently conflated with port 47; otherwise the historical file-transfer lineage (e.g. 20/21 FTP)

Primary use

none currently (Reserved/removed). Historically ni-ftp — NI FTP (Network Independent File Transfer Protocol), a UK file-transfer protocol documented in IEN 99 (May 1979), not an RFC; obsolete since the JANET Coloured Book → Internet transition (from late 1991)

Other/unofficial uses

Unknown — no current named software implementation found in public sources [Unknown]

Security implications

unassigned well-known port with no expected legitimate service since 2017-05-18; unexpected traffic may indicate misconfiguration, scanning probes, or undocumented port reuse. No 47/udp-specific CVEs or campaigns found in public sources as of mid-2026

Typically seen on

no expected host class — an open 47/udp is an anomaly today

Analyst note

47/udp is Reserved/removed at IANA and has no current registered service. Do not confuse it with GRE (IP protocol 47). Treat a live 47/udp as an anomaly worth investigating rather than a normal service.