496

Port 496/tcp is IANA-registered to the name pim-rp-disc, but the real-world protocol behind that name — Cisco's Auto-RP mechanism for PIM Sparse-Mode multicast rendezvous-point discovery — runs over UDP, not TCP; a listener on 496/tcp is essentially unused in practice and, if seen, should stay internal to trusted multicast-routing infrastructure rather than face the public internet.

The IANA Service Names and Port Numbers registry lists pim-rp-disc ("PIM-RP-DISC") for both 496/tcp and 496/udp, assignee Dino Farinacci, with a blank Reference field and no registration date recorded.

Auto-RP lets PIM routers discover a Rendezvous Point automatically instead of requiring static configuration: Candidate-RPs send RP-Announce messages to multicast group 224.0.1.39, and the elected Mapping Agent sends RP-Discovery messages to 224.0.1.40, both over UDP port 496. Cisco documentation consistently describes this as a UDP mechanism used on IOS and IOS XE routers and switches (including the Catalyst 9600 series); no source found describes a distinct service actually running on 496/tcp.

Measured open-frequency in the nmap-services corpus reflects this split: 496/tcp sits at 0.000013 (~0.0013%) versus 0.001153 (~0.115%) for 496/udp — nearly two orders of magnitude rarer — consistent with the TCP side of the dual registration being a name reservation that was never implemented as a working service.

Exposure

Internal-only — Auto-RP is an enterprise multicast routing control-plane mechanism between trusted routers, not a service designed for public exposure, and TCP 496 in particular has no documented legitimate service listening on it.

Vulnerability status

No CVE or vulnerability advisory tied to port 496 was found in a search as of August 2026.

Malware association

No malware or trojan association for port 496 was found as of an August 2026 search; an attempt to retrieve auditmypc.com's port-496 pages did not return usable content, so no positive or negative claim from that source is cited here.

Anomaly signal

An open 496/tcp listener with no corresponding Auto-RP deployment is unusual given the near-zero measured prevalence and warrants investigation as a misconfiguration or non-standard service rather than assumed legitimate use.

IANA assignment

pim-rp-disc — "PIM-RP-DISC"; reference (blank — none recorded); assignee Dino Farinacci; dual-registered 496/tcp + 496/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry pim-rp-disc 496/tcp

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 496/tcp = 0.000013 (~0.0013%); 496/udp = 0.001153 (~0.115%) [Confirmed] — this site's own tooling (built from nmap-services)

Related ports

496/udp (the operationally relevant Auto-RP transport) [Confirmed]

Primary use

name tied to Cisco's Auto-RP mechanism for PIM Sparse-Mode multicast Rendezvous Point discovery, documented as running over UDP 496 with multicast groups 224.0.1.39/224.0.1.40

Security implications

internal multicast control-plane mechanism; no CVE found and no confirmable malware verdict as of an August 2026 search

Typically seen on

Cisco IOS/IOS XE routers and switches running PIM Sparse-Mode with Auto-RP, via UDP; 496/tcp is essentially unseen in the wild

TCP-specific use

no distinct protocol or software found actually listening on 496/tcp; the dual IANA registration appears to be a name reservation rather than an implemented TCP service [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Analyst note

an open 496/tcp is statistically rare and has no documented legitimate TCP service behind it — treat as anomalous rather than assume it is a live Auto-RP mapping agent.

Port 496/udp carries pim-rp-disc, the transport IANA registers for Cisco's proprietary Auto-RP mechanism, and it should stay inside a trusted multicast-routing domain rather than face the public internet.

IANA lists 496/udp (and the paired 496/tcp) as pim-rp-disc, "PIM-RP-DISC," with the registry's contact field naming Dino Farinacci and no RFC listed in the Reference column. There is no standards-track RFC behind the assignment; the protocol is Cisco's own pre-standard alternative to BSR for distributing rendezvous-point mappings in PIM Sparse-Mode multicast.

Independent CCIE/networking study references (not Cisco's own site, which returned HTTP 403 on direct fetch) describe two message types sharing this port: RP-Announce, sent by candidate rendezvous-points to multicast group 224.0.1.39 to advertise willingness to serve as RP, and RP-Discovery, sent by Mapping Agents to 224.0.1.40 to distribute the elected RP-to-group mapping domain-wide.

Corpus prevalence for 496/udp measures at an open-frequency of 0.001153 (~0.115%) in the repo's nmap-services-derived data, versus 0.000013 for 496/tcp — both low but the udp side meaningfully more common, consistent with Auto-RP's udp-only wire behavior.

Exposure

Auto-RP is unauthenticated, multicast, router-to-router control-plane signaling internal to a PIM domain — it should never be reachable from or exposed to the public internet.

Protocol risk

RP-Announce/RP-Discovery messages carry no built-in source authentication at the protocol level, so an untrusted device able to reach this port inside a multicast domain could inject spoofed RP mappings.

CVE status

No CVE is recorded in the NVD as of an August 2026 search tied specifically to UDP port 496, pim-rp-disc, or Cisco Auto-RP.

Malware association

No malware or trojan association is documented for this port as of an August 2026 search; legacy port-lookup aggregator pages (auditmypc.com, SpeedGuide) could not be retrieved with substantive content to cite either way.

IANA assignment

pim-rp-disc — "PIM-RP-DISC"; Reference column blank (registry's contact field names Dino Farinacci, not an RFC); dual-registered 496/tcp + 496/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry pim-rp-disc 496/udp

Range class

well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry pim-rp-disc 496/udp

Prevalence

nmap-services open-frequency 496/udp = 0.001153 (~0.115%); 496/tcp = 0.000013 [Confirmed] — this site's own tooling

Related ports

496/tcp (same IANA registration, far lower observed prevalence); other PIM/multicast control-plane traffic in the same routing domain

Primary use

transport for Cisco's proprietary Auto-RP mechanism — RP-Announce (to 224.0.1.39) and RP-Discovery (to 224.0.1.40) for PIM-SM rendezvous-point mapping distribution

Other/unofficial uses

none documented beyond Auto-RP in this search [Unknown]

Security implications

unauthenticated UDP multicast router control-plane protocol; no CVE found for this port/service as of an August 2026 NVD search

Typically seen on

Cisco IOS/IOS-XE and NX-OS routers/multicast-layer-3 switches configured as candidate-RPs or Mapping Agents for Auto-RP

Analyst note

An externally reachable 496/udp is not a normal internet-facing service — Auto-RP belongs strictly inside a trusted multicast routing domain, so exposure to an untrusted network is worth investigating as misconfiguration.