517

Port 517/tcp is registered with IANA as talk with the verbose description "like tenex link, but across machine - unfortunately, doesn't use link protocol (this is actually just a rendezvous port from which a tcp connection is established)" and blank assignee, contact, and reference fields (the identical string is registered on 517/udp). It is the original talk protocol — real-time two-user terminal chat — served by talkd. Per the canonical talkd description, the talk server acts as a repository of invitations: a caller sends a control message look-up, then an announce, the server broadcasts on the callee's login ports, and when the callee responds the clients establish a stream connection through which the conversation takes place. The transport behavior is the key nuance: in practice the control and rendezvous happen over UDP, and the actual conversation uses a separately negotiated TCP stream, which is exactly what the registry note means by "just a rendezvous port from which a tcp connection is established" (this split across UDP and TCP is why talk is notoriously hard to proxy). The original talk uses 517; the incompatible newer protocol moved to 518 (ntalk). The IANA reference field is blank. Security-wise it is an obsolete chat daemon with no encryption or authentication, talkd had historical vulnerabilities, and it has a minimal modern footprint; nmap-services records 517/udp activity but effectively zero on TCP, confirming the UDP-centric behavior. For an analyst, an open 517 (more likely on UDP) indicates an antique Unix host running talkd and is almost always vestigial, so it should be disabled.

IANA assignment

talk — "like tenex link, but across machine - unfortunately, doesn't use link protocol (this is actually just a rendezvous port from which a tcp connection is established)"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 517/tcp + 517/udp (UDP carries the control/rendezvous)

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 517/tcp ~0.000000 (UDP ~0.004794) (de-facto) [Well-established] — nmap-services file

Related ports

518 (ntalk — the newer, incompatible talk)

Primary use

real-time two-user terminal chat (talkd) [Well-established]

Other/unofficial uses

none today [Well-established]

Security implications

obsolete; no encryption/auth; historical talkd vulnerabilities; minimal modern footprint [Well-established]

Typically seen on

old Unix hosts running in.talkd

Analyst note

An open 517 (more likely UDP) indicates an antique Unix host running talkd — almost always vestigial; disable.