52
Summary
- // if you see it open
- No documented CVEs or known exploits for XNS Time Protocol. As an unauthenticated time-sync service it carries theoretical traffic-amplification / time-spoofing risk if exposed, but no well-documented real-world attacks exist. Low exposure volume reflects near-total obsolescence; block at the perimeter where XNS is unused.
- // analyst note
- A responsive port 52 is statistically rare and best read as a legacy-XNS or embedded-stack signal; legitimate modern use is unlikely. Block at the perimeter if XNS is not in use.
About port 52/tcp.
Port 52/tcp is registered with IANA as xns-time with the description "XNS Time Protocol," assignee Susie Armstrong, and a blank reference field; it is dual-registered on both TCP and UDP under the same service name and assignee. The IANA Reference column carries no RFC, and the registry's Registration Date and Modification Date columns are both blank, so no assignment date can be stated. XNS Time Protocol is part of the Xerox Network Systems (XNS) protocol suite that Xerox developed in the late 1970s and 1980s; it provided clock synchronization on XNS networks, where a client queried a centralized time server and adjusted its local clock from the response — functionally the XNS-era analogue of what NTP does on TCP/IP networks. The same assignee, Susie Armstrong, holds the adjacent XNS Clearinghouse registration on port 54, reflecting the common Xerox lineage of this block. For an analyst, port 52 matters mainly as a relic: XNS has been superseded by TCP/IP, and time synchronization is handled today by NTP on 123/udp, so a responsive port 52 most plausibly indicates legacy Xerox hardware, an old mainframe, or an industrial/embedded stack still running XNS-era code rather than a current production service. Public scanning telemetry shows low but persistent automated probing of port 52, consistent with internet-wide sweep traffic rather than targeted exploitation, and there are no documented CVEs or widely cited software implementations for XNS Time Protocol in reachable public sources. As with any unauthenticated time-sync service, internet exposure carries a theoretical risk of traffic amplification or time spoofing, but no well-documented real-world attacks on this port exist; the standard posture is to block it at the perimeter where XNS is not in use.
- IANA assignment
xns-time— "XNS Time Protocol"; reference (blank — no RFC cited in IANA registry); assignee Susie Armstrong; dual-registered 52/tcp + 52/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (corroborated by local registry CSV lines 112–113)- Range class
- well-known (0–1023) [Confirmed]
- Registration date
- Unknown — IANA publishes no registration date; the registry date columns are blank and IEEE/IANA assign no public date. Third-party "date registered" values are database artifacts and are not cited [Unknown]
- Related ports
- 54/tcp (xns-ch, XNS Clearinghouse, same assignee); 123/udp (NTP, the modern time-sync replacement)
Primary use
XNS-era clock synchronization — client queries a centralized time server and adjusts its clock; the XNS-suite analogue of NTP [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml; https://whatportis.com/ports/52_xns-xerox-network-systems-time-protocol
Protocol family
Xerox Network Systems (XNS), developed by Xerox in the late 1970s–1980s; same assignee (Susie Armstrong) as XNS Clearinghouse on port 54
Common software
Unknown — no widely cited implementations are documented in reachable public sources [Unknown]
Exposure / scanning notes
low but persistent automated probing logged on port 52, consistent with internet-wide sweeps rather than targeted attacks; no documented CVEs or known exploits for XNS Time Protocol
- Modern usage status
- effectively obsolete; superseded by TCP/IP, with NTP (123/udp) handling time sync. May appear on legacy Xerox hardware, old mainframes, or XNS-era industrial stacks; no documented active deployment[Likely] — https://whatportis.com/ports/52_xns-xerox-network-systems-time-protocol; http://www.t1shopper.com/tools/port-number/52/
- Analyst note
- A responsive port 52 is statistically rare and best read as a legacy-XNS or embedded-stack signal; legitimate modern use is unlikely. Block at the perimeter if XNS is not in use.
About port 52/udp.
Port 52/udp is registered with IANA as xns-time with the description "XNS Time Protocol," assignee Susie Armstrong (Xerox), and a blank reference field — and it is dual-registered with identical fields on 52/tcp. XNS (Xerox Network Systems) was a protocol suite developed at Xerox PARC in the late 1970s, and its Time Protocol provided clock synchronisation for XNS-managed networks: a client host queried a time server and adjusted its clock, similar in purpose to NTP (port 123) but specific to the XNS environment. The Time Protocol specification is dated April 1984 (document reference XNSS 088404 / XSIS 088404). One subtlety worth keeping straight: within XNS itself the service was reached by well-known socket number 8 (per IANA's XNS protocol-types registry), which is a distinct identifier from the TCP/IP port 52 assignment recorded in the service-names registry — the two should not be conflated. XNS is obsolete; it was fully displaced by TCP/IP, and no currently maintained software is known to implement XNS Time Protocol on port 52. Historically it ran on Xerox workstations and servers (e.g., the Xerox Star / 6085 lineage). For an analyst, port 52 carries no active user base: no documented internet-facing exposure, no known CVEs, and no notable mass-scanning campaigns specifically target it. The IANA reference field is blank — no RFC is cited — and no registration or modification date is recorded in the registry, so those values are genuinely unknown rather than assumed. A responsive port 52 on a modern host is therefore extremely unlikely to be a legitimate XNS service and is better treated as a misassignment, decoy, or some other service squatting on the number.
- IANA assignment
xns-time— "XNS Time Protocol"; reference (blank — no RFC cited in IANA registry); assignee Susie Armstrong; dual-registered 52/tcp + 52/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?page=2); the IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Registration date
- Unknown — no registration date appears in the IANA port registry; no verifiable primary-source date found (any third-party value would be a database artifact) [Unknown] — IANA registry (blank)
- Modification date
- Unknown — blank in the IANA registry [Unknown] — IANA registry (blank)
- Status
- Obsolete / Legacy — XNS is no longer deployed; port 52 remains in the IANA well-known registry but carries no active user base [Confirmed] — https://en.wikipedia.org/wiki/Xerox_Network_Systems
- Related ports
- time/clock services for contrast —
/port/123(NTP),/port/37(time); the XNS-adjacent registrations on neighbouring numbers
Primary use
clock synchronisation within XNS-managed networks (XNS Time Protocol; spec dated April 1984, ref XNSS 088404 / XSIS 088404) [Confirmed] — https://en.wikipedia.org/wiki/Xerox_Network_Systems ; https://www.iana.org/assignments/xns-protocol-types/xns-protocol-types.xml
Common software
none currently maintained known to implement XNS Time Protocol on port 52; historically Xerox XNS workstations/servers (Xerox Star / 6085)
Security implications / exposure
no documented active internet-facing exposure, no known CVEs, and no notable mass-scanning campaigns specifically targeting port 52 found in open sources (Shodan ports status, SANS, security blogs); the protocol is obsolete and extremely unlikely to be listening on modern internet-facing hosts
Typically seen on
historically Xerox XNS hosts; on a modern network, an anomaly / possible misassignment or decoy
- XNS internal identifier
- well-known socket number 8 within XNS — distinct from the TCP/IP port 52 assignment; do not conflate [Confirmed] — https://www.iana.org/assignments/xns-protocol-types/xns-protocol-types.xml
- Analyst note
- An open port 52 is statistically rare and tied to an obsolete suite; treat as an anomaly to investigate rather than a normal service. Legitimate XNS use is highly unlikely today.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| xns-time | UDP | XNS Time Protocol | 0.04% |
| xns-time | TCP | XNS Time Protocol | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.