496

Port 496/tcp is IANA-registered to the name pim-rp-disc, but the real-world protocol behind that name — Cisco's Auto-RP mechanism for PIM Sparse-Mode multicast rendezvous-point discovery — runs over UDP, not TCP; a listener on 496/tcp is essentially unused in practice and, if seen, should stay internal to trusted multicast-routing infrastructure rather than face the public internet.

The IANA Service Names and Port Numbers registry lists pim-rp-disc ("PIM-RP-DISC") for both 496/tcp and 496/udp, assignee Dino Farinacci, with a blank Reference field and no registration date recorded.

Auto-RP lets PIM routers discover a Rendezvous Point automatically instead of requiring static configuration: Candidate-RPs send RP-Announce messages to multicast group 224.0.1.39, and the elected Mapping Agent sends RP-Discovery messages to 224.0.1.40, both over UDP port 496. Cisco documentation consistently describes this as a UDP mechanism used on IOS and IOS XE routers and switches (including the Catalyst 9600 series); no source found describes a distinct service actually running on 496/tcp.

Measured open-frequency in the nmap-services corpus reflects this split: 496/tcp sits at 0.000013 (~0.0013%) versus 0.001153 (~0.115%) for 496/udp — nearly two orders of magnitude rarer — consistent with the TCP side of the dual registration being a name reservation that was never implemented as a working service.

IANA assignment

pim-rp-disc — "PIM-RP-DISC"; reference (blank — none recorded); assignee Dino Farinacci; dual-registered 496/tcp + 496/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry pim-rp-disc 496/tcp

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 496/tcp = 0.000013 (~0.0013%); 496/udp = 0.001153 (~0.115%) [Confirmed] — this site's own tooling (built from nmap-services)

Related ports

496/udp (the operationally relevant Auto-RP transport) [Confirmed]

Primary use

name tied to Cisco's Auto-RP mechanism for PIM Sparse-Mode multicast Rendezvous Point discovery, documented as running over UDP 496 with multicast groups 224.0.1.39/224.0.1.40

Security implications

internal multicast control-plane mechanism; no CVE found and no confirmable malware verdict as of an August 2026 search

Typically seen on

Cisco IOS/IOS XE routers and switches running PIM Sparse-Mode with Auto-RP, via UDP; 496/tcp is essentially unseen in the wild

TCP-specific use

no distinct protocol or software found actually listening on 496/tcp; the dual IANA registration appears to be a name reservation rather than an implemented TCP service [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Analyst note

an open 496/tcp is statistically rare and has no documented legitimate TCP service behind it — treat as anomalous rather than assume it is a live Auto-RP mapping agent.

Port 496/udp carries pim-rp-disc, the transport IANA registers for Cisco's proprietary Auto-RP mechanism, and it should stay inside a trusted multicast-routing domain rather than face the public internet.

IANA lists 496/udp (and the paired 496/tcp) as pim-rp-disc, "PIM-RP-DISC," with the registry's contact field naming Dino Farinacci and no RFC listed in the Reference column. There is no standards-track RFC behind the assignment; the protocol is Cisco's own pre-standard alternative to BSR for distributing rendezvous-point mappings in PIM Sparse-Mode multicast.

Independent CCIE/networking study references (not Cisco's own site, which returned HTTP 403 on direct fetch) describe two message types sharing this port: RP-Announce, sent by candidate rendezvous-points to multicast group 224.0.1.39 to advertise willingness to serve as RP, and RP-Discovery, sent by Mapping Agents to 224.0.1.40 to distribute the elected RP-to-group mapping domain-wide.

Corpus prevalence for 496/udp measures at an open-frequency of 0.001153 (~0.115%) in the repo's nmap-services-derived data, versus 0.000013 for 496/tcp — both low but the udp side meaningfully more common, consistent with Auto-RP's udp-only wire behavior.

IANA assignment

pim-rp-disc — "PIM-RP-DISC"; Reference column blank (registry's contact field names Dino Farinacci, not an RFC); dual-registered 496/tcp + 496/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry pim-rp-disc 496/udp

Range class

well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry pim-rp-disc 496/udp

Prevalence

nmap-services open-frequency 496/udp = 0.001153 (~0.115%); 496/tcp = 0.000013 [Confirmed] — this site's own tooling

Related ports

496/tcp (same IANA registration, far lower observed prevalence); other PIM/multicast control-plane traffic in the same routing domain

Primary use

transport for Cisco's proprietary Auto-RP mechanism — RP-Announce (to 224.0.1.39) and RP-Discovery (to 224.0.1.40) for PIM-SM rendezvous-point mapping distribution

Other/unofficial uses

none documented beyond Auto-RP in this search [Unknown]

Security implications

unauthenticated UDP multicast router control-plane protocol; no CVE found for this port/service as of an August 2026 NVD search

Typically seen on

Cisco IOS/IOS-XE and NX-OS routers/multicast-layer-3 switches configured as candidate-RPs or Mapping Agents for Auto-RP

Analyst note

An externally reachable 496/udp is not a normal internet-facing service — Auto-RP belongs strictly inside a trusted multicast routing domain, so exposure to an untrusted network is worth investigating as misconfiguration.