515

Port 515/tcp is registered with IANA as printer with the description "spooler" (the same service name and description are registered on 515/udp) and blank assignee, contact, and reference fields. It carries network print-job submission and queue control via the Line Printer Daemon protocol, documented in RFC 1179 (August 1990, Informational): a TCP-based protocol between clients (lpr to submit, lpq to query, lprm to remove, lpc to control) and the server (lpd), where a request is a one-byte command code — for example 01 "Print any waiting jobs" or 02 "Receive a printer job" — followed by arguments and an ASCII line feed, with control files carrying job metadata such as the 'H' responsible host and 'P' responsible user. RFC 1179 specifies that connections to 515 should originate from privileged ports 721–731, though most BSD lpd implementations only check for any reserved port. LPD originated in the BSD Berkeley printing system; LPRng and CUPS (the default on modern Linux and macOS) also speak LPD alongside IPP. The IANA reference field is blank (the protocol is documented in RFC 1179, but the row cites no reference). Security-wise this port has the most concrete vulnerability history in its batch: CVE-2000-0917 was a format-string flaw in LPRng's use_syslog() (LPRng 3.6.24 and earlier) allowing unauthenticated remote root code execution on port 515, disclosed on Bugtraq 25 September 2000 and covered by CERT Advisory CA-2000-22, and it was exploited by the Ramen worm (around January 2001), which on Red Hat 7.0 used the LPRng hole to gain root, deface web pages, and self-propagate (documented in CERT Incident Note IN-2001-01); older BSD/Solaris in.lpd and LPRng buffer overflows also exist. For an analyst, an open 515 is usually a print server or network printer — sometimes with weak or default security — so fingerprint the implementation (BSD lpd vs LPRng vs CUPS), check LPD/LPRng vulnerability exposure, and segment printers off general networks.

IANA assignment

printer — "spooler" (515/tcp and 515/udp); reference (blank — RFC 1179 is the defining spec but is NOT cited in the registry row); assignee/contact blank; dual-registered 515/tcp + 515/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.007214 (de-facto; common, driven by printers) [Well-established] — nmap-services file

Related ports

631 (IPP), 9100 (raw/JetDirect)

Primary use

network print-job submission and spooler/queue control (LPD, RFC 1179)

Other/unofficial uses

CUPS LPD listener, Windows Print Services LPD, network printers [Well-established]

Security implications

CVE-2000-0917 (LPRng use_syslog() format string → remote root, Bugtraq 25 Sep 2000, CERT CA-2000-22); Ramen worm (~Jan 2001, CERT IN-2001-01); older BSD/Solaris lpd buffer overflows

Typically seen on

print servers, network/TCP-IP printers, CUPS hosts, Windows LPD, legacy Unix lpd

Analyst note

An open 515 is usually a print server or network printer (sometimes weak/default security); fingerprint the implementation and check LPD/LPRng vuln exposure; segment printers off general networks.

Port 515/udp is registered with IANA as printer with the description "spooler," dual-registered alongside 515/tcp; the assignee, contact, registration date, modification date, and reference fields are all blank in the IANA registry (genuine blanks, not fabricated nulls). The well-known protocol associated with port 515 is LPD, the Line Printer Daemon protocol defined in RFC 1179 (August 1990) — but RFC 1179 is not listed in the IANA Reference column for this entry, so it is not cited as an IANA reference here. Crucially, LPD is a TCP-only protocol: RFC 1179 specifies the daemon listens on TCP port 515, and all documented real-world software (the original BSD UNIX Berkeley printing system, LPRng, CUPS' LPD compatibility layer, the Windows LPD Print Service, and network printers from HP, Xerox, and others) speaks LPD over TCP. The UDP registration at 515 is a mirrored legacy reservation from the era when IANA routinely dual-registered ports across both transports; no distinct application, RFC, or protocol is documented as operationally using 515/udp. For an analyst this matters as a disambiguation point: the entire exposure and threat surface of port 515 — RFC 1179 defines no authentication, encryption, or access control, so any reachable host can submit, delete, or flood print jobs, and the most recent notable vulnerability is CVE-2025-21224 (a CVSS 8.1 unauthenticated RCE in the Windows LPD service, patched 14 January 2025) — lives at the TCP layer. Scanners such as nmap may enumerate 515/udp during full-range sweeps because of the dual registration, but standard systems return no meaningful response; treat 515/udp as effectively inert and route any genuine LPD investigation to 515/tcp.

IANA assignment

printer — "spooler"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 515/tcp + 515/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, udp line 1051 / tcp line 1050)

Range class

well-known (0–1023)

Related ports

515/tcp (the operational LPD port); 631 (IPP/CUPS), 9100 (raw/JetDirect printing)

Primary use

LPD (Line Printer Daemon, RFC 1179) is the documented protocol on port 515 but is TCP-only; 515/udp has no documented operational protocol use

Other/unofficial uses

none documented for 515/udp; the UDP slot is a mirrored legacy reservation only

Common software (TCP layer, for context)

BSD Berkeley printing system, LPRng, CUPS (LPD compatibility), Windows LPD Print Service; network printers (HP, Xerox) historically shipped LPD on 515/tcp

Security implications

LPD's RFC 1179 has no authentication/encryption/access control — reachable hosts can submit/delete/flood print jobs (DoS); most recent notable vuln is CVE-2025-21224 (CVSS 8.1, unauthenticated RCE in Windows LPD service, patched 14 Jan 2025; affects Windows Server 2025, Windows 11 24H2, earlier with LPD enabled; no in-the-wild exploitation noted at patch release). All of this is TCP-layer; 515/udp itself returns no meaningful response on standard systems

Typically seen on

legacy network printers and print servers (on 515/tcp); 515/udp open is an anomaly with no documented service behind it

Analyst note

515/udp is IANA-mirrored but operationally unused — no RFC, spec, or software targets it over UDP. Real LPD exposure is on 515/tcp; treat a responsive 515/udp as noteworthy and verify rather than assuming an active service.