476
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — The name is registered but undocumented, has no confirmed application, and shows an open-frequency of 0 in the nmap corpus, so legitimate use is essentially unknown and any sighting should be treated as anomalous.
- // analyst note
- A responsive 476/tcp has no benign explanation on file — the IANA name is undocumented and unconfirmed in practice, so treat it as worth investigating rather than routine.
- // if you see it open
- No CVE or malware family is documented for 476/tcp as of an August 2026 search. auditmypc.com's port-476 page carries only the site's standard templated framing, not a port-specific verdict — an absence of evidence rather than a documented clean bill. The port is essentially unused and undocumented in practice, so a responsive 476/tcp on a live host is anomalous and warrants local investigation (e.g. identifying the owning process) rather than being explained by the IANA registration.
About port 476/tcp.
Port 476/tcp carries no documented protocol at all; it is registered with IANA under the name tn-tl-fd1 but with no reference, no accompanying description, and no evidence of real-world software using it, so it should be treated as an unused legacy registration rather than a service anyone should expect to see exposed, internally or publicly.
IANA lists tn-tl-fd1 identically on both 476/tcp and 476/udp, assigned to Ed Kress, with a blank Reference field and no registration or modification date recorded. No RFC or vendor specification for the name has surfaced, and the description field simply repeats the service name rather than explaining what it does.
The only concrete sighting found is a mid-2000s Windows forum thread in which a user found svchost.exe listening on 476/tcp and asked what "tn-tl-fd1" meant; other participants concluded the IANA name only labels the port number and does not identify the actual process, and pointed the user toward local tools like netstat -b instead. No specific application was ever confirmed as the cause.
Nmap's port-frequency corpus records 476/tcp at an open-frequency of exactly 0 (sampled, not observed open) and 476/udp at roughly 0.035%, consistent with a port that is effectively never used.
- IANA assignment
tn-tl-fd1; reference blank; assignee Ed_Kress; dual-registered 476/tcp + 476/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (tn-tl-fd1 476/tcp and 476/udp)- Range class
- system/well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
- Prevalence
- nmap-services open-frequency 476/tcp = 0 (sampled, not observed open); 476/udp ≈ 0.000346 (~0.035%) [Confirmed] — this site's own tooling
- Related ports
- 476/udp (identical IANA name, dual registration) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
Primary use
Unknown — no protocol description, RFC, or vendor spec is recorded for tn-tl-fd1
Other/unofficial uses
Unknown; one inconclusive Windows forum sighting of svchost.exe on 476/tcp with no application confirmed
Security implications
no CVE or malware family documented as of an August 2026 search; essentially unused port, so any activity is anomalous
Typically seen on
not established; no consistent host type or software documented [Unknown]
- Analyst note
- A responsive 476/tcp has no benign explanation on file — the IANA name is undocumented and unconfirmed in practice, so treat it as worth investigating rather than routine.
About port 476/udp.
Port 476/udp carries the IANA-registered service tn-tl-fd1; no protocol specification, vendor deployment guide, or real-world application sighting has been found for it, so it should be treated as an unclassified legacy registration rather than something knowingly exposed to the public internet.
IANA lists port 476 as tn-tl-fd1, dual-registered on TCP and UDP, assignee [Ed_Kress], with a blank Reference column and no registration date recorded in the registry. The tn-tl- prefix recurs across a small cluster of otherwise-unrelated port numbers — 474/tcp+udp (tn-tl-w1/tn-tl-w2), 1580/tcp+udp (tn-tl-r1/tn-tl-r2), and 1584/tcp+udp (tn-tl-fd2) — and [Ed_Kress] appears on 474/udp, 476/tcp, 476/udp, 1580/udp, and both 1584 rows, while 474/tcp (tn-tl-w1) and 1580/tcp (tn-tl-r1) carry no assignee at all. IANA does not document what product or protocol this family belongs to, so the grouping remains a registry naming pattern, not a confirmed relationship.
The only discoverable community reference is a PPRuNe forum thread in which a user reported unexplained traffic labeled tn-tl-fd1 on port 476 and never identified the responsible application; the thread confirms the bare registered name exists but reaches no conclusion about what generates the traffic. No CVE, malware campaign, or scanning report specific to 476/udp was found as of an August 2026 search.
The nmap-services corpus (as compiled in this repo's port-data.json) records an open-frequency of 0.000346 for 476/udp and 0 for 476/tcp — both readings indicating essentially no observed open instances in the underlying scan corpus, consistent with the port's lack of documented deployment.
- IANA assignment
tn-tl-fd1; reference (blank); assignee[Ed_Kress]; dual-registered 476/tcp + 476/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry tn-tl-fd1 476/udp- Range class
- well-known/system (0–1023) [Confirmed] — port number 476 falls in the IANA system range
- Prevalence
- nmap-services open-frequency 476/udp = 0.000346; 476/tcp = 0 [Confirmed] — this site's own tooling (built from nmap-services)
- Related ports
- 474/tcp+udp (
tn-tl-w1/tn-tl-w2), 1580/tcp+udp (tn-tl-r1/tn-tl-r2), and 1584/tcp+udp (tn-tl-fd2) — same tn-tl- naming pattern;[Ed_Kress]appears on 474/udp, 1580/udp, and both 1584 rows, but 474/tcp and 1580/tcp carry no assignee at all, so this is a registry naming pattern, not a confirmed shared-registrant relationship[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
Primary use
Unknown — no protocol specification or description document found beyond the registered name tn-tl-fd1
Other/unofficial uses
Unknown; a PPRuNe forum thread reports unresolved tn-tl-fd1 traffic on this port without identifying the source application
Security implications
no CVE or malware/trojan association found as of an August 2026 search; no documented scanning or exploitation activity tied to 476/udp [Unknown/negative finding]
Typically seen on
Unknown — no application or host-type attribution found
- Analyst note
- an observed 476/udp session should be investigated on its own merits — the registered name shares a naming pattern with the adjacent tn-tl-* cluster, and
[Ed_Kress]is the assignee on some but not all of those rows, but no protocol detail, vendor, or exposure guidance is publicly documented for the family.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| tn-tl-fd1 | UDP | — | 0.03% |
| tn-tl-fd1 | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.