489

Port 489/tcp is registered with IANA under the service name nest-protocol, but no independent technical specification or confirmed real-world deployment was found for it, so an open 489/tcp should be treated as unusual rather than something expected to face the public internet.

IANA lists only the bare service name for both 489/tcp and 489/udp, with the assignee and registry contact both recorded as Gilles_Gameiro, a blank Reference column (no RFC or other specification linked), and no registration or modification date on file.

The name nest-protocol is coincidental. Third-party protocol documentation places the Google Nest Labs Nest Protect device protocol on a different port entirely (TCP/UDP 11095), so no link to that product line should be inferred from the name alone.

Prevalence data from the repo's nmap-services-derived corpus records 489/tcp at an open-frequency of exactly 0 — sampled but never observed open — while 489/udp sits at roughly 0.000544. Neither figure indicates active or common deployment.

IANA assignment

nest-protocol — description "nest-protocol"; blank Reference field; assignee/contact Gilles_Gameiro; dual-registered 489/tcp + 489/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nest-protocol 489/tcp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nest-protocol 489/tcp

Prevalence

nmap-services open-frequency 489/tcp = 0 (sampled, not observed open); 489/udp ≈ 0.000544 [Confirmed] — this site's own tooling

Related ports

489/udp (dual-registered, identical service name) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nest-protocol 489/udp

Primary use

Unknown — no independent technical description of the protocol's actual behavior was found beyond the bare IANA name

Other/unofficial uses

none found

Security implications

no CVE or malware family confirmed as of an August 2026 search; essentially undocumented outside the bare registry entry, so treat an open instance as anomalous

Typically seen on

Unknown — no confirmed real-world deployments found [Unknown]

Analyst note

nest-protocol on 489/tcp is thinly documented and should not be linked to Google Nest Labs' Nest Protect protocol (a different port, 11095) [Likely] — https://www.netify.ai/resources/protocols/nest-protect

Port 489/udp is IANA-registered under the name nest-protocol, but no protocol definition, RFC, or working application has ever been documented for it, so an open 489/udp is not expected public-internet traffic and should be treated as atypical if seen.

The IANA registry lists the service name nest-protocol for both 489/tcp and 489/udp, assignee Gilles Gameiro, with a blank Reference field — there is no RFC or other formal specification backing the name. No descriptive text beyond the bare service name accompanies the entry.

Despite the name, this registration is unrelated to Google's Nest smart-home ecosystem. Google's Nest Protect device protocol is documented as running on TCP/UDP port 11095, not 489, so the shared word "nest" is coincidental rather than a real connection.

Measured prevalence backs up the obscurity: the repo's nmap-services-derived dataset records an open-frequency of 0.000544 (~0.05%) for 489/udp and exactly 0 for 489/tcp — a real sampled reading of "not observed open," not a gap in the data.

No community-sourced documentation (vendor pages, blog posts, forum threads) of any specific application generating traffic on 489/udp surfaced in an August 2026 search, and no CVE or malware/trojan association was found for this port as of that search. SANS Internet Storm Center's per-port page for 489 showed a "green" (no elevated concern) status with no scan-source or attack-volume data populated at the time of the check.

IANA assignment

nest-protocol — no descriptive text beyond the name; reference (blank — no RFC cited); assignee [Gilles_Gameiro]; dual-registered 489/tcp + 489/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nest-protocol 489/udp

Range class

well-known (0–1023) [Confirmed] — port number value

Prevalence

nmap-services open-frequency 489/udp = 0.000544 (~0.05%); 489/tcp = 0 (sampled, not observed open) [Confirmed] — this site's own tooling

Related ports

none documented as a meaningful cluster for this port [Unknown]

Primary use

no protocol definition, RFC, or documented implementation exists beyond the registered name

Other/unofficial uses

none documented

Security implications

no CVE or malware/trojan association found; ISC SANS shows "green" (low-concern) scanning status

Typically seen on

no host type documented; an open 489/udp is atypical [Unknown]

Not Google Nest

name is coincidental; Google's Nest Protect protocol is documented on port 11095, not 489 [Likely] — https://www.netify.ai/resources/protocols/nest-protect

Analyst note

489/udp is a registered-but-undefined service name with near-zero measured prevalence and no known application — treat a live listener as an anomaly to investigate, not a routine finding.