509
Summary
- // typical exposure
- Restricted (trusted networks only) — Documented real-world traffic on this port is an LDAP-based enterprise directory/entitlements service (CA Directory-EEM) that should be limited to trusted management networks, not exposed to the public internet.
- // common applications
- CA Directory (itechpoz/dxserver)CA EEM (Embedded Entitlements Manager)CA Autosys Workload Automation Traffic on this port is most often LDAP/TLS directory-bind activity; Broadcom support documentation reports CA Directory/EEM, a component of CA Autosys Workload Automation, using it for entitlement lookups.
- // analyst note
- an open port 509 is most plausibly a CA Directory/EEM LDAP endpoint; check for anonymous bind exposure before assuming it is benign.
- // if you see it open
- Broadcom knowledge-base article KB 371351 documents a vulnerability-scan finding of an SSL server on port 509 permitting anonymous LDAP authentication ('NULL BIND', nmap shows 'Anonymous bind OK'), traced to an auth-levels setting in CA Directory's itechpoz.dxc normally only needed during initial EEM cluster setup. Broadcom KB 232099 documents the same anonymous-authentication finding via a Qualys scan. Broadcom KB 74517 documents vendor remediation: enabling TLS 1.2 with a strong ciphersuite list (ECDHE-RSA-AES256-GCM-SHA384 and similar) on ports 509, 5250, 8443 and 9443; it does not name any specific weak cipher or attack (e.g. RC4/ARCFOUR, Sweet32), so those specifics are not asserted. No CVE or malware-family association with port 509 was found as of an August 2026 search.
About port 509/tcp.
Port 509/tcp carries CA Directory / EEM (Embedded Entitlements Manager), an LDAP directory-bind component of CA (Broadcom) Autosys Workload Automation; it should stay restricted to trusted internal or management networks rather than be exposed to the public internet.
The IANA registry lists the service name snare for both 509/tcp and 509/udp, assignee Dennis_Batchelder, with a blank Reference column; the Description column repeats the service name rather than giving an actual expansion, and no registration or modification date is recorded.
The name is a coincidence, not a pointer to the well-known Snare SIEM/log-collection product from Intersect Alliance / Prophecy International: that product's own network-ports documentation lists ports 6161-6163, 6261-6262, and 80/443, and does not mention 509 anywhere.
The best-attested real-world sighting comes from Broadcom's own knowledge base: support articles describe CA Directory / EEM (internal process names itechpoz/dxserver), used within CA Autosys, listening on port 509 for LDAP directory binds. These are vendor remediation guides written after customer vulnerability scans (e.g. Qualys) flagged findings, not independent telemetry, and none of the fetched pages carried a publication date.
Measured open-frequency from the repo's nmap-services-derived dataset is low for both transports — 0.000075 for 509/tcp and 0.000643 for 509/udp — consistent with a niche enterprise-directory service rather than anything broadly deployed or internet-facing.
- Exposure
- Restricted — where port 509 is open it is most plausibly a CA Directory/EEM LDAP endpoint for enterprise workload-automation software, which belongs on trusted/management networks, not the open internet.
- Notable finding
- Broadcom knowledge-base article KB 371351 documents a vulnerability-scan finding of anonymous LDAP authentication ("Anonymous bind OK" via nmap) against the EEM server on port 509, traced to
auth-levels = anonymous, clear-passwordinitechpoz.dxc, a setting normally only needed during initial EEM cluster setup (https://knowledge.broadcom.com/external/article/371351/eem-null-bind-on-port-509.html). - Vendor remediation
- Broadcom KB 74517 walks through enabling TLS 1.2 and a strong ciphersuite list (
ECDHE-RSA-AES256-GCM-SHA384and similar) on ports 509, 5250, 8443 and 9443; the article does not name any specific weak cipher or attack such as RC4/ARCFOUR or Sweet32, so those specifics are not asserted here (https://knowledge.broadcom.com/external/article/74517/enabling-tlsv12-and-strong-ciphers-on-p.html). - Related finding
- Broadcom KB 232099 documents a Qualys scan (ID 38142) flagging an SSL server on port 509 (
dxserver) for allowing anonymous authentication, consistent with the NULL-BIND finding above (https://knowledge.broadcom.com/external/article/232099/qualys-scan-id-38142-ssl-server-allows.html). - Malware/trojan association
- Unknown — no CVE or malware family tied specifically to port 509 was found in an August 2026 search; auditmypc.com's port-509 page was not used to support any verdict here.
- IANA assignment
snare— description field repeats the service name; reference column blank; assignee Dennis_Batchelder; dual-registered 509/tcp + 509/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry snare 509/tcp- Range class
- system/well-known (0-1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry snare 509/tcp
- Prevalence
- nmap-services open-frequency 509/tcp = 0.000075; 509/udp = 0.000643 [Confirmed] — this site's own tooling
- Related ports
- CA Directory/EEM-related ports 5250, 8443 and 9443 cited alongside 509 in the same Broadcom TLS-hardening guide [Likely] — https://knowledge.broadcom.com/external/article/74517/enabling-tlsv12-and-strong-ciphers-on-p.html
Primary use
community-sourced as CA Directory / EEM (Embedded Entitlements Manager) LDAP directory bind used by CA Autosys Workload Automation
Other/unofficial uses
none additional identified beyond the CA Directory/EEM sighting [Unknown]
Security implications
Broadcom-documented anonymous LDAP bind (NULL BIND) on port 509, remediated via vendor-documented TLS 1.2 + strong-ciphersuite hardening; no weak-cipher family (e.g. RC4/Sweet32) is named in the cited sources, and no established malware association was found
Typically seen on
enterprise hosts running CA (Broadcom) Autosys Workload Automation / CA Directory-EEM
- Analyst note
- an open port 509 is most plausibly a CA Directory/EEM LDAP endpoint; check for anonymous bind exposure before assuming it is benign.
About port 509/udp.
Port 509/udp carries no defined protocol at all; IANA registers the bare name "snare" here but cites no RFC or reference document, so nothing should legitimately run on it and it does not belong exposed to the public internet.
The IANA Service Name and Transport Protocol Port Number Registry assigns 509 to "snare" on both tcp and udp, credited to assignee Dennis Batchelder, with the reference, registration-date, and modification-date columns all left blank [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry, key: snare 509/udp).
The name coincides with the commercial "Snare" audit-log agent from InterSect Alliance / Prophecy International, but that product's own current documentation — its Snare Agent Manager wiki, Appendix A, fetched live this pass — lists agent/management ports as TCP 6161 (Snare Enterprise Agents), TCP 6162 (Snare Enterprise Epilog), TCP 6163 (Snare Enterprise Agent for MSSQL), TCP 6261 (Web Management Interface), TCP 6262 (inbound from v5 agents), and TCP 80/443 (Agent Management Console). Port 509 does not appear anywhere on that page, and none of the listed ports carries a documented UDP variant, so a link between the IANA bare-name assignment and the modern commercial product is not established [Confirmed] (prophecyinternational.atlassian.net/wiki/spaces/SAM/pages/89146240/Appendix+A+-+Network+Ports+and+Protocols).
Separately, this port number's TCP sibling (509/tcp, a distinct registry row) is best attested in real-world use as CA Directory / EEM (Embedded Entitlements Manager, an LDAP directory-bind component of CA/Broadcom AutoSys Workload Automation): Broadcom's own knowledge base documents CA Directory/EEM (internal process names itechpoz/dxserver) listening on TCP port 509 for LDAP directory binds, including TLSv1.2 enablement and a separate advisory on an anonymous/NULL LDAP bind exposure there. That documented traffic is specifically TCP — an LDAP directory-bind service, TLS-capable — with no UDP counterpart documented anywhere found, so it neither confirms nor contradicts this 509/udp entry; the two sibling pages describe genuinely different, non-conflicting situations, split by transport rather than by disagreement.
Measured open-frequency in the nmap-services corpus is 0.000643 for 509/udp (about 0.064%) and 0.000075 for 509/tcp, both near-zero — consistent with a port that is rarely, if ever, legitimately open [Confirmed] (this site's own tooling).
- Exposure
- Anomalous for 509/udp specifically — no protocol specification exists for this UDP assignment, so a responsive port is unexpected and should be investigated rather than assumed benign; this verdict is per-transport, not a blanket call on the port number, since the 509/tcp sibling is a named, documented enterprise LDAP service.
- Scanning caveat
- UDP is connectionless, so an unanswered probe is ambiguous between closed and filtered, and the source address is spoofable — treat any observed traffic on this port cautiously.
- Prevalence
- Open-frequency is near-zero in the nmap-services sampling corpus (0.064% udp, 0.0075% tcp), reinforcing that this port is rare in practice.
- IANA assignment
snare— reference blank; assignee Dennis Batchelder; dual-registered 509/tcp + 509/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, key: snare 509/udp- Range class
- well-known/system (0-1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
- Prevalence
- nmap-services open-frequency 509/udp ~ 0.000643 (~0.064%); 509/tcp ~ 0.000075 (~0.0075%) [Confirmed] — this site's own tooling
- Related ports
- none confirmed — the Snare commercial product's TCP ports (6161, 6162, 6163, 6261, 6262, 80, 443) do not include 509 and have no documented UDP variants; 514/udp (syslog) does not appear on the Snare documentation [Confirmed/Unknown]
Primary use
no documented protocol specification exists beyond the bare IANA name; RFC/reference field is blank
Other/unofficial uses
no confirmed relation to the commercial Snare audit-log agent (InterSect Alliance / Prophecy International) — its documented agent ports are TCP 6161/6162/6163/6261/6262/80/443, and 509 does not appear on its own current network-ports documentation
Security implications
no CVE or malware family recorded as of an August 2026 search [Confirmed negative] — no citation (absence confirmed by search); auditmypc.com's port-509 page was checked but renders only generic tool-interface text with no port-509-specific verdict, so it was not used to support any verdict here
Typically seen on
no credible community sightings of software generating 509/udp traffic found; any observed traffic should be treated as anomalous pending investigation [Unknown]
- Sibling note
- 509/tcp (a separate registry row) is documented by Broadcom as the CA Directory / EEM LDAP directory-bind port used by itechpoz/dxserver, explicitly "TCP port 509" in KB 232099, TLS-capable; this is TCP-specific with no documented UDP counterpart, so it does not describe this 509/udp entry[Confirmed] — Broadcom KB 74517; Broadcom KB 232099; Broadcom KB 371351
- Analyst note
- An open 509/udp has no established legitimate protocol behind it — a sourced Unknown is the honest baseline, and observed traffic warrants investigation rather than assumption that it is either the commercial Snare product or the unrelated 509/tcp CA Directory/EEM LDAP service documented on the sibling page.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| snare | UDP | — | 0.06% |
| snare | TCP | — | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.