49
Summary
- // if you see it open
- Critical AAA infrastructure guarding network control-plane access. TACACS+ obfuscates the body with an MD5-based stream of security properties similar to RADIUS's weak User-Password scheme (RFC 8907 §4.5), and a cleartext+IP-filter mode exists. Compromise/interception is high-impact. Confine to a protected management network; never expose to untrusted networks.
- // analyst note
- An open 49 is a network-device AAA (TACACS+) server — internet-facing exposure is a serious misconfiguration warranting immediate remediation.
About port 49/tcp.
Port 49/tcp is registered with IANA as tacacs with the description "Login Host Protocol (TACACS)," assignee Pieter Ditmars, and a blank reference field (dual-registered on TCP and UDP). Two distinct protocols share this port, and the distinction matters. The first is TACACS itself, documented in RFC 1492 (July 1993, informational) as a historic ARPANET-era access-control protocol going back to the 1980s. The second — and the one that actually runs on TCP 49 across modern networks — is TACACS+, a Cisco-designed complete rewrite that is incompatible with its predecessors; it provides authentication, authorization, and accounting (AAA) for administering network devices, separates those three functions cleanly (including per-command authorization), and obfuscates the packet body while leaving the header in cleartext. TACACS+ is documented informationally in RFC 8907 (2020). The IANA reference field for the port is blank. TACACS+ is the de-facto standard for controlling administrative access to routers, switches, firewalls, and similar gear, which makes it crown-jewel infrastructure: compromise or interception of a TACACS+ server is high-impact because it guards access to the network's control plane. RFC 8907 is candid that the body obfuscation uses an MD5-based stream with security properties similar to RADIUS's weak User-Password scheme, and one operating mode sends data in cleartext with only IP-based filtering — so TACACS+ should be confined to a protected management network and never exposed to untrusted ones. For an analyst, an open 49 is a network-device AAA server, and finding one internet-facing is a serious misconfiguration that warrants immediate remediation.
- IANA assignment
tacacs— "Login Host Protocol (TACACS)"; reference (blank — no RFC cited in IANA registry); assignee Pieter Ditmars; dual-registered 49/tcp + 49/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- present in nmap-services at modest frequency (de-facto) [Well-established] — nmap-services file
- Related ports
- 1812/1813 (RADIUS auth/accounting), 65 (TACACS-Database Service)
Primary use
AAA for network-device administration (TACACS+ over TCP 49)
Other/unofficial uses
historic TACACS (RFC 1492) [Well-established]
Security implications
critical AAA infrastructure; TACACS+ body obfuscation is MD5-based with known weaknesses (RFC 8907 §4.5); a cleartext+IP-filter mode exists; never expose to untrusted networks; management-network only
Typically seen on
TACACS+ AAA servers on network-management segments
- Analyst note
- An open 49 is a network-device AAA (TACACS+) server — internet-facing exposure is a serious misconfiguration warranting immediate remediation.
About port 49/udp.
Port 49/udp is registered with IANA as tacacs with the description "Login Host Protocol (TACACS)," assignee Pieter Ditmars, and a blank reference field — the same service name and description are dual-registered on 49/tcp. The name comes from TACACS (Terminal Access Controller Access-Control System), one of the earliest AAA (authentication, authorization, accounting) protocols: it originated at BBN for authentication on the ARPANET/MILNET, with RFC 927 (December 1984) formalizing an initial TACACS Telnet option and the informational RFC 1492 (July 1993, C. Finseth) later documenting both the UDP and TCP encodings of the protocol on port 49. The crucial distinction for an analyst is that the *original* TACACS protocol — the one that uses UDP — transmits credentials in cleartext, whereas the modern Cisco-derived successor TACACS+ (specified in the informational RFC 8907, 2020) runs over TCP port 49 *only* and never uses UDP. Consequently a live UDP/49 endpoint implies legacy TACACS rather than TACACS+, and any response should be treated as an obsolete authentication service carrying cleartext-credential risk. Legitimate UDP/49 today is essentially confined to historical or misconfigured equipment — older Cisco routers, terminal servers, and UNIX network access servers — because contemporary AAA stacks use TACACS+ (TCP) or RADIUS instead. The IANA reference field is blank, and IANA publishes no registration date for this entry, so both are left null rather than inferred. Port 49/udp does not appear prominently in major internet-wide scan datasets, consistent with the protocol's obsolescence, and there are no CVEs tied specifically to the UDP/49 surface as distinct from TACACS+ TCP issues; the cleartext password exposure is the dominant risk where the port is reachable.
- IANA assignment
tacacs— "Login Host Protocol (TACACS)"; reference (blank — no RFC cited in IANA registry); assignee Pieter Ditmars; dual-registered 49/tcp + 49/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=49); the IANA Service Name and Transport Protocol Port Number Registry line 108 (udp)- Range class
- well-known (0–1023) [Confirmed] — port number 49
- Prevalence
- not prominent in major internet-wide scan datasets (Shodan/Censys), consistent with obsolescence; no reliable nmap-services open-frequency figure verified for this entry [Likely] — https://www.auditmypc.com/udp-port-49.asp, https://hackviser.com/tactics/pentesting/services/tacacs
- Related ports
- 49/tcp (TACACS / TACACS+); 1812–1813/udp and 1645–1646/udp (RADIUS, the alternative AAA transport)
Primary use
original TACACS AAA protocol (authentication/authorization/accounting); UDP encoding documented in RFC 1492 (July 1993, informational)
Other/unofficial uses
occasionally listed under the legacy alias bbn-login
Security implications
original TACACS transmits passwords in cleartext over UDP (passive eavesdropping risk); protocol is obsolete and guidance is to disable UDP/49; no known malware specific to this port; a live UDP/49 response indicates legacy authentication with cleartext-credential exposure [Confirmed] — Wikipedia: TACACS, https://www.auditmypc.com/udp-port-49.asp, https://www.verylazytech.com/network-pentesting/tacacs+-port-49
Typically seen on
legacy Cisco routers/terminal servers, older UNIX network access servers (NAS), historical ARPANET/MILNET infrastructure; otherwise an anomaly / misconfiguration
- Transport distinction
- legacy TACACS supports UDP and TCP on port 49; TACACS+ (RFC 8907) is TCP-only and does NOT use UDP, so UDP/49 implies legacy TACACS, not TACACS+ [Confirmed] — RFC 8907 (https://datatracker.ietf.org/doc/rfc8907/), Wikipedia: TACACS
- Analyst note
- UDP/49 is a legacy-TACACS indicator. Modern TACACS+ is TCP-only, so a UDP/49 responder is either old equipment or a misconfiguration and should be treated as an obsolete service with cleartext-credential risk.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| tacacs | UDP | Login Host Protocol (TACACS) | 1.40% |
| tacacs | TCP | Login Host Protocol (TACACS) | 0.07% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.