506
Summary
- // if you see it open
- No CVE is recorded in the NVD referencing port 506, and no malware or trojan association is documented in verified sources, as of an August 2026 search. The service's function is undocumented beyond its IANA name, so no legitimate deployment can be confirmed; an open 506/tcp is statistically rare (measured open-frequency of 0) and should be investigated rather than assumed legitimate.
- // analyst note
- An open port 506 has a measured open-frequency of 0 and no documented service function; treat it as unusual and investigate rather than assume legitimacy.
About port 506/tcp.
Port 506/tcp carries a service IANA registers only as "ohimsrv," with no description beyond the name and no RFC reference on file; because the protocol is otherwise undocumented and no legitimate deployment has been verified, it should not be expected as an internet-facing service and an open instance is worth investigating rather than assuming benign.
The IANA registry dual-registers 506 on both TCP and UDP under the name "ohimsrv," assignee [Scott_Powell]. The description field simply repeats the service name, the reference field is blank, and no registration or modification date is recorded — so the underlying protocol was apparently never formalized through an RFC or public specification.
Measured prevalence supports the "essentially unseen" picture: nmap-services records an open-frequency of exactly 0 for 506/tcp (a real sampled reading, not an unresearched gap) and about 0.000577 for 506/udp. Neither figure suggests any meaningful current deployment.
One candidate application association surfaced during research — Dantz/Retrospect backup software — but it does not hold up: Retrospect's own documentation cites 497/tcp+udp as its client/server port, not 506, so that claim is retracted rather than reported. No other vendor documentation, CVE, or malware association could be confirmed for this port as of an August 2026 search.
- Prevalence
- nmap-services open-frequency for 506/tcp is 0 (measured, sampled with no observed open instances); 506/udp measured at approximately 0.000577.
- Retracted claim
- an initial association with Dantz/Retrospect backup software was checked against Retrospect's own documentation and found incorrect — Retrospect documents port 497/tcp+udp, not 506.
- IANA assignment
ohimsrv— description field repeats "ohimsrv" (no expansion); reference blank; assignee [Scott_Powell]; dual-registered 506/tcp + 506/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ohimsrv 506/tcp- Range class
- well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ohimsrv 506/tcp
- Prevalence
- nmap-services open-frequency 506/tcp = 0 (measured, sampled with no observed open instances); 506/udp ≈ 0.000577 [Confirmed] — this site's own tooling
- Related ports
- 497/tcp+udp (Retrospect backup — the port sometimes confused with 506)
Primary use
undocumented; no RFC or vendor specification found describing the "ohimsrv" protocol as of an August 2026 search
Other/unofficial uses
none verified; a claimed Dantz/Retrospect backup association was checked and disproven (Retrospect documents port 497/tcp+udp)
Security implications
no CVE recorded in the NVD referencing port 506, and no malware/trojan association documented in verified sources, as of an August 2026 search [Unknown/negative finding]
Typically seen on
unknown — no verified sightings of specific software or host types generating traffic on this port [Unknown]
- Analyst note
- An open port 506 has a measured open-frequency of 0 and no documented service function; treat it as unusual and investigate rather than assume legitimacy.
About port 506/udp.
Port 506/udp is registered with IANA under the bare name ohimsrv, but no vendor documentation, RFC, or independent technical description of what the service does could be found, so whether it belongs on the public internet cannot be confirmed either way; a host answering on 506/udp should be investigated rather than assumed safe or unsafe.
The IANA registry lists only the service name ohimsrv (identical text repeated in the description field), assignee Scott Powell, and a blank RFC/reference column — both TCP and UDP carry the same dual registration. No primary source explains the protocol's purpose beyond that bare listing.
Community-sourced candidates for "what runs here" were checked and rejected as unverifiable: a Juniper Threat Labs application-signature page names an "OHIMSRV" app-ID but maps it to different ports (TCP 434/3386, UDP 3544/3386/5246-5247), not 506 itself, so it does not confirm real traffic on this port. SEO aggregator sites repeat a claim that Dantz/EMC Retrospect backup software uses port 506, but no primary Retrospect documentation or credible forum/KB sighting corroborates it, so it is not asserted here.
SANS Internet Storm Center's per-port page for 506 showed only minimal scan activity at time of check (two source IPs, six scans each) with the site's overall threat level green and no CVE or user reports attached. This is a snapshot, not a trend.
- Exposure
- Unknown — no research surfaced a documented use for
ohimsrv, so no curated internet-facing/restricted/internal-only judgment can be made honestly. - Scan activity
- SANS ISC recorded only minimal probe volume (two source IPs, six scans each) at the time of an August 2026 check, with the port's overall threat level green.
- Malware/CVE
- No CVE is recorded in the NVD as of 2026-08, and no credible malware or trojan association for 506/udp was found in this search.
- Unverified candidates
- A Juniper Threat Labs "OHIMSRV" app-ID and a Dantz/Retrospect backup-software claim both surfaced in the research but neither could be independently confirmed as generating traffic specifically on 506/udp.
- IANA assignment
ohimsrv— description field repeats the service name with no further text; reference (blank — no RFC cited); assignee Scott Powell; dual-registered 506/tcp + 506/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ohimsrv 506/udp- Range class
- system/registered (registrations 1024 and below are well-known; 506 falls in the well-known range per IANA's numeric split) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ohimsrv 506/udp
- Prevalence
- nmap-services open-frequency 506/udp = 0.000577 (~0.058%); 506/tcp = 0 (sampled, not observed open) [Confirmed] — this site's own tooling
- Related ports
- 506/tcp (identical IANA registration, dual-registered)
Primary use
Unknown — IANA gives only the bare name ohimsrv with no protocol description, RFC, or vendor documentation located
Other/unofficial uses
none independently confirmed; a Juniper Threat Labs "OHIMSRV" signature and an aggregator-repeated Dantz/Retrospect claim were checked and could not be corroborated
Security implications
no CVE recorded in NVD as of 2026-08; no credible malware/trojan association found; SANS ISC shows only minimal scan volume (2 source IPs, 6 scans each) at an August 2026 check with green threat level
Typically seen on
Unknown — no documented deployment pattern found
- Analyst note
- An open 506/udp is lightly documented; treat it as unexplained and worth investigating rather than assuming either a benign or malicious purpose.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ohimsrv | UDP | — | 0.06% |
| ohimsrv | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.