520

Port 520/tcp carries the IANA-registered efs (Extended File Name Server) service, a largely obsolete legacy file-name-mapping protocol; it should generally stay internal-only rather than exposed to the public internet, since no current, widely used application is documented running on it.

The IANA registry lists 520/tcp as efs with description "extended file name server" and a blank Reference field — no RFC is cited for the assignment. This is a separate registration from 520/udp, which IANA assigns to router (also called route), the well-known Routing Information Protocol (RIP, RFC 1058) used by routers to exchange distance-vector tables; the two protocols on the shared port number are unrelated in practice.

Community discussion traces the efs name to a mid-1980s file-name-mapping/directory service associated with older UNIX and DECnet environments, with one account describing an early Macintosh-client file daemon that was subsequently registered with IANA under this name. Usage is described as having declined as directory protocols like LDAP took over, and no current vendor product was verifiably confirmed as generating TCP/520 traffic in a light research pass.

No malware or trojan association is documented for 520/tcp in the sources checked; a page cataloguing the port lists only the IANA efs registration with no virus/trojan verdict attached.

Exposure

Treat 520/tcp as internal-only at most — it is an obsolete, sparsely documented legacy file-name service with no confirmed modern application, so there is no reason to expose it to the public internet.

Distinct from 520/udp

Don't confuse this entry with 520/udp (RIP), which is a widely deployed, legitimate router protocol with its own separate exposure profile.

Scanning visibility

Port 520 (covering both tcp/udp) appears in general vulnerability-scanner target lists, and a dedicated attack-activity tracking page exists for the port number, though this pass could not retrieve that page's live dated figures.

IANA assignment

efs — "extended file name server"; Reference field blank; assignee not listed [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry efs 520/tcp

Range class

system/well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 520/tcp = 0 (sampled, not observed open); 520/udp (route/RIP) ≈ 0.139376 for comparison [Confirmed] — this site's own tooling

Related ports

520/udp (route/RIP, the far more common assignment on this port number); the /port/ hub

Primary use

legacy extended file-name-server protocol, largely obsolete; no RFC cited by IANA [Likely] — https://whatportis.com/ports/520_efs-extended-file-name-server, https://community.hpe.com/t5/Networking/What-is-efs-520-tcp-Extended-file-name-server/td-p/4890161

Other/unofficial uses

reported historical 1980s Macintosh-client file daemon lineage

Security implications

no documented malware/trojan association for 520/tcp; port 520 (tcp+udp) appears in general vulnerability-scanner target lists [Likely] — https://www.auditmypc.com/tcp-port-520.asp, https://support.holmsecurity.com/knowledge/what-ports-are-included-in-the-different-scan-levels

Typically seen on

legacy UNIX/DECnet-era hosts historically; otherwise an anomaly given no confirmed current use [Likely]

Paired UDP assignment

router/route — "local routing process (on site); uses variant of Xerox NS routing information protocol - RIP" (RFC 1058) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry router 520/udp

Analyst note

A responsive 520/tcp is unusual — the efs service is largely obsolete with no confirmed modern software, so investigate rather than assume routine infrastructure; don't confuse it with the widely deployed 520/udp RIP service.

Port 520/udp carries the Routing Information Protocol, a distance-vector interior gateway protocol and one of the oldest routing protocols still found in the field. The IANA service name is router, with the period-piece description "local routing process (on site); uses variant of Xerox NS routing information protocol - RIP." RIPv1 (RFC 1058, June 1988) is classful and broadcasts its routing table; RIPv2 (RFC 2453, November 1998) adds classless (VLSM) support, multicast updates to 224.0.0.9, route tags, and authentication. RIP uses hop count as its only metric, capped at 15 hops (16 means unreachable) to bound the count-to-infinity problem, and routers send periodic full-table updates every 30 seconds plus triggered updates, leaning on split horizon and route poisoning to limit loops. It is largely legacy today — superseded by OSPF and EIGRP because of slow convergence and the 15-hop diameter limit — and RIPng for IPv6 (RFC 2080) runs on the separate UDP port 521. The security story is the usual one for an old unauthenticated protocol: RIPv1 has no authentication, so any host on a segment can inject false routes for traffic redirection, blackholing, or man-in-the-middle; RIPv2 added plaintext-password authentication (trivially sniffed/spoofed) and later Keyed-MD5 (RFC 2082, 1997; revised with SHA support in RFC 4822, 2007, which itself documents an active attack on the mechanism). RIP should never be exposed to the internet. For an analyst, an open 520/udp usually marks a router or Layer-3 device running a legacy IGP; on a non-router it is anomalous and worth investigating, and the authentication posture and interface exposure should be checked. Note the transport split: 520/tcp is a different, obscure legacy service — efs (extended file name server).

IANA assignment

router — "local routing process (on site); uses variant of Xerox NS routing information protocol - RIP"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; governing protocol RFC 1058 (RIPv1) / RFC 2453 (RIPv2), not the IANA-cited reference

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 0.139376 (common on network infrastructure) [Well-established] — nmap-services file

Related ports

521 (ripng, RIPng for IPv6, multicast FF02::9); 520/tcp (efs — different service); 179 BGP / OSPF (proto 89) as modern routing siblings

Primary use

RIP distance-vector interior gateway routing updates over UDP

Other/unofficial uses

none notable beyond RIP itself [n/a]

Security implications

RIPv1 unauthenticated → route injection/poisoning/blackhole/MITM; RIPv2 plaintext or Keyed-MD5 auth (RFC 2082/4822, the latter documenting an attack); never internet-expose

Typically seen on

routers and Layer-3 switches running legacy IGP configs

Analyst note

Open 520/udp usually marks a router/L3 device running legacy RIP. On a non-router it is anomalous; verify the authentication posture and keep it off internet-facing interfaces.