518

Port 518/tcp is registered with IANA as ntalk with a blank description field (the service name is registered with no description string on both 518/tcp and 518/udp) and blank assignee, contact, and reference fields. It is ntalk (ntalkd / in.ntalkd), the BSD 4.3 revision of the talk protocol with an incompatible, changed message format — the talk and ntalk protocols do not interoperate — implementing the same real-time two-user chat model. Like the original talk, it is primarily a UDP service: client-to-ntalkd control runs over UDP 518, with a separate data path for the conversation, and ALG documentation for the talk family notes it uses UDP 517 and 518 for control while opening both TCP and UDP gates for the session. The IANA reference field is blank, and the registry carries no description for this entry. Security-wise it shares the same obsolescence as talk — no encryption or authentication and a negligible modern footprint. For an analyst, an open 518 indicates a legacy ntalk daemon and should be treated as cruft and disabled.

IANA assignment

ntalk — (description blank in registry); reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 518/tcp + 518/udp (UDP carries the control) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 518/tcp ~0.000013 (de-facto) [Well-established] — nmap-services file

Related ports

517 (talk — the original, incompatible protocol)

Primary use

real-time two-user chat (ntalkd, the BSD 4.3 revised talk) [Well-established]

Other/unofficial uses

none today [Well-established]

Security implications

obsolete; no encryption/auth; negligible modern footprint [Well-established]

Typically seen on

old Unix running in.ntalkd

Analyst note

An open 518 indicates a legacy ntalk daemon; treat as cruft and disable.

Port 518/udp carries ntalk, the legacy Unix real-time text-chat protocol; it has no legitimate reason to sit exposed to the public internet, and in practice it almost never legitimately runs today. IANA registers ntalk on both 518/tcp and 518/udp, with the description, assignee, and reference fields all blank in the current registry row.

ntalk ("new talk") is the successor to the original talk protocol on port 517, using an incompatible wire format from its predecessor. Both are served by a talk daemon — ntalkd, also seen as in.ntalkd — that shipped historically with BSD Unix and older Solaris/Linux distributions, invoked through inetd. A client sends a UDP negotiation packet to the remote host's ntalkd, and on acceptance the two ends open a duplex, unauthenticated terminal chat session.

No modern consumer or commercial software is documented as generating traffic on this port. The one vendor artifact found is Juniper's Junos TALK ALG, which exists to shepherd talk/ntalk negotiation through NAT and firewalls rather than to originate traffic itself. nmap-services records an open-frequency of about 0.022208 (~2.2%) for 518/udp, versus roughly 0.000013 for 518/tcp, consistent with UDP carrying the actual client-to-daemon negotiation.

Exposure

Anomalous — a legacy, cleartext, unauthenticated chat protocol with no documented current legitimate deployment; treat an open 518/udp as vestigial or as a signal worth investigating.

Confidentiality

ntalk sessions carry no authentication or encryption, so anyone able to reach the port can attempt to negotiate a session or eavesdrop on one.

Notable advisory

Historical BSD talk-daemon advisories document remote-root buffer overflows in some implementations, e.g. FreeBSD-SA-96:21.talkd (1996), predating the CVE system; it is not confirmed whether that advisory named ntalkd specifically or only the older talkd it descends from.

IDS signature

auditmypc.com's port-518 reference page notes an IDS signature for an "ntalkd x86 Linux overflow" condition.

Malware association

auditmypc.com records no malware/virus association for UDP 518 as of an August 2026 check.

IANA assignment

ntalk — no description text, no assignee, no reference populated on either 518/tcp or 518/udp; dual-registered [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ntalk 518/udp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ntalk 518/udp

Prevalence

nmap-services open-frequency 518/udp ≈0.022208 (~2.2%); 518/tcp ≈0.000013 [Confirmed] — this site's own tooling (built from nmap-services)

Related ports

517/tcp and 517/udp (talk — older, incompatible protocol)

Primary use

legacy Unix real-time chat protocol, successor to talk (517), served by ntalkd/in.ntalkd via inetd

Other/unofficial uses

no modern application documented; Juniper Junos TALK ALG references talk/ntalk negotiation handling for NAT traversal

Security implications

cleartext, unauthenticated legacy protocol; historical BSD talkd remote-root overflow advisory (FreeBSD-SA-96:21.talkd, 1996, not confirmed ntalkd-specific); auditmypc.com IDS signature for an ntalkd Linux overflow condition; no malware/trojan association recorded

Typically seen on

legacy/antique Unix hosts running ntalkd; otherwise anomalous [Likely]

Analyst note

An open 518/udp today is almost always vestigial or anomalous — investigate rather than assume legitimate use.