516
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — videotex is a legacy 1980s-era service with essentially no modern deployment, so a responsive 516/tcp is unexpected on any current host and should be treated as an anomaly to investigate rather than a normal service.
- // analyst note
- A responsive 516/tcp is not expected on any modern host; treat it as an anomaly signal pending further investigation rather than a known-benign service.
- // if you see it open
- videotex has essentially no modern deployment, so an open 516/tcp is anomalous and worth investigating. No reliable source confirms or denies a malware/trojan association for this port specifically as of an August 2026 search. SANS Internet Storm Center tracks port 516 on its general scan-activity dashboard, indicating it appears in background internet scanning, though specific volume figures were not retrievable.
About port 516/tcp.
Port 516/tcp carries no documented modern service; it is an IANA-registered legacy assignment (videotex) that should not be found open on a public-facing host today. No current software was reliably confirmed as generating traffic here, so any live listener on 516/tcp is unusual and worth investigating rather than assumed benign.
IANA lists 516/tcp (dual-registered with 516/udp) under the service name videotex, assigned to Daniel Mavrakis, with a blank Reference field — no RFC documents this assignment. Videotex itself was a pre-web interactive text-information service delivering news, weather, travel data, directory lookups, and messaging over telephone or managed network links, mainly deployed by telecom and information providers in the 1980s through the early 1990s.
No RFC or formal specification for the port-516 assignment was located. The protocol predates the modern internet's structured RFC-driven port-registration norms typical of many low-numbered legacy assignments from that era, and IANA's registry entry itself carries no further descriptive text beyond the service name.
Present-day sightings of 516/tcp traffic are essentially undocumented. A single web search surfaced a possible mention linking an SAP print service to this port, but the source page could not be fetched or verified, so it is deliberately excluded here rather than cited unverified.
- Exposure
- Legacy/anomalous — videotex is not a service any modern host should expose; an open 516/tcp is unexpected and merits investigation. [Likely]
- Scanning visibility
- SANS Internet Storm Center tracks port 516 on its general port-activity dashboard, indicating it receives background internet scan traffic, though specific volume/trend figures were not retrievable. [Likely] — https://isc.sans.edu/data/port/516
- IANA assignment
videotex— description "videotex"; assignee Daniel_Mavrakis; Reference field blank; dual-registered 516/tcp + 516/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, row videotex 516/tcp- Range class
- system/well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 516/tcp = 0.000013 (~0.0013%); 516/udp = 0.000807 (~0.08%) [Confirmed] — this site's own tooling
- Related ports
- 516/udp (dual registration); other legacy system-range assignments from the same 1980s IANA era
Primary use
legacy videotex interactive text-information service (news, weather, travel, directory, messaging), deployed by telecom/information providers roughly 1980s–early 1990s; no RFC located
Other/unofficial uses
none reliably documented; a possible SAP-related forum mention could not be verified and is not included [Unknown]
Security implications
essentially never legitimately open today; no confirmed malware association found; monitored on general internet scan-activity trackers
Typically seen on
no known modern deployment; an open instance is an anomaly worth investigating [Unknown]
- Analyst note
- A responsive 516/tcp is not expected on any modern host; treat it as an anomaly signal pending further investigation rather than a known-benign service.
About port 516/udp.
Port 516/udp carries the IANA-registered videotex service; it is an obsolete legacy protocol with no known modern software, so a responsive 516/udp today is anomalous rather than a normal service that belongs on any network, public or private. IANA registers 516 on both tcp and udp under the service name videotex, assignee Daniel_Mavrakis, with a blank reference field and no RFC cited.
Videotex refers to a family of interactive text-information retrieval systems — news, weather, directory-style lookups — delivered over dial-up telephone and other managed network links, dating to systems popular from the 1980s into the early 1990s (the Minitel-era style of service is the best-known example). The IANA registry documents only the port/name assignment; it does not describe a specific wire protocol, and no RFC defines one.
No vendor product, client, or daemon binding to 516/udp turned up in vendor documentation, blog posts, or forum/support threads searched as of an August 2026 search; generic port-reference sites list only the bare IANA registration, not an observed application. The udp assignment reads as a paired reservation alongside 516/tcp rather than a separately documented protocol with distinct behavior.
- Exposure
- videotex is an obsolete dial-up-era protocol with no known current implementation — treat any responsive 516/udp as anomalous and worth investigating rather than as a legitimate service.
- Malware/trojan association
- not listed as malware/trojan-associated on auditmypc.com's port pages (a negative finding, cited from that site's own verdict line, not its boilerplate caution text).
- Scanning activity
- no port-specific scanning or attack-activity statistics could be retrieved as of an August 2026 search; ambient internet-wide background scanning is plausible for any low-numbered port but no dated measurement was found for 516/udp specifically.
- Software exposure
- no application or daemon is confirmed to bind this port today, so there is no known software-specific vulnerability surface to weigh — the risk is purely an unexplained-open-port signal.
- IANA assignment
videotex— reference (blank); assignee Daniel_Mavrakis; dual-registered 516/tcp + 516/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry videotex 516/udp- Range class
- well-known/system (0–1023) [Confirmed] — this site's own tooling (port 516, range "system")
- Prevalence
- nmap-services open-frequency 516/udp ≈ 0.000807 (~0.08%); 516/tcp ≈ 0.000013 [Confirmed] — this site's own tooling (port 516, udp service entry)
- Related ports
- 516/tcp (
videotex, dual registration) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry videotex 516/tcp
Primary use
legacy interactive text-information retrieval technology (videotex, Minitel-era style services), delivered historically over dial-up/managed network links; no RFC or detailed wire-protocol spec found
Other/unofficial uses
none found; no vendor software or daemon reported using this port as of an August 2026 search
Security implications
no authentication model or vulnerability history is documented for this obsolete protocol; a responsive 516/udp is best treated as an anomaly signal rather than a normal service
Typically seen on
not typically seen on modern hosts; historically associated with legacy dial-up videotex terminals/gateways [Unknown]
- Analyst note
- An open 516/udp has no known legitimate modern use — investigate as a misconfiguration, decoy, or unrelated service squatting on the port rather than assuming genuine videotex traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| videotex | UDP | — | 0.08% |
| videotex | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.