520

Port 520/udp carries the Routing Information Protocol, a distance-vector interior gateway protocol and one of the oldest routing protocols still found in the field. The IANA service name is router, with the period-piece description "local routing process (on site); uses variant of Xerox NS routing information protocol - RIP." RIPv1 (RFC 1058, June 1988) is classful and broadcasts its routing table; RIPv2 (RFC 2453, November 1998) adds classless (VLSM) support, multicast updates to 224.0.0.9, route tags, and authentication. RIP uses hop count as its only metric, capped at 15 hops (16 means unreachable) to bound the count-to-infinity problem, and routers send periodic full-table updates every 30 seconds plus triggered updates, leaning on split horizon and route poisoning to limit loops. It is largely legacy today — superseded by OSPF and EIGRP because of slow convergence and the 15-hop diameter limit — and RIPng for IPv6 (RFC 2080) runs on the separate UDP port 521. The security story is the usual one for an old unauthenticated protocol: RIPv1 has no authentication, so any host on a segment can inject false routes for traffic redirection, blackholing, or man-in-the-middle; RIPv2 added plaintext-password authentication (trivially sniffed/spoofed) and later Keyed-MD5 (RFC 2082, 1997; revised with SHA support in RFC 4822, 2007, which itself documents an active attack on the mechanism). RIP should never be exposed to the internet. For an analyst, an open 520/udp usually marks a router or Layer-3 device running a legacy IGP; on a non-router it is anomalous and worth investigating, and the authentication posture and interface exposure should be checked. Note the transport split: 520/tcp is a different, obscure legacy service — efs (extended file name server).

IANA assignment

router — "local routing process (on site); uses variant of Xerox NS routing information protocol - RIP"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; governing protocol RFC 1058 (RIPv1) / RFC 2453 (RIPv2), not the IANA-cited reference

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 0.139376 (common on network infrastructure) [Well-established] — nmap-services file

Related ports

521 (ripng, RIPng for IPv6, multicast FF02::9); 520/tcp (efs — different service); 179 BGP / OSPF (proto 89) as modern routing siblings

Primary use

RIP distance-vector interior gateway routing updates over UDP

Other/unofficial uses

none notable beyond RIP itself [n/a]

Security implications

RIPv1 unauthenticated → route injection/poisoning/blackhole/MITM; RIPv2 plaintext or Keyed-MD5 auth (RFC 2082/4822, the latter documenting an attack); never internet-expose

Typically seen on

routers and Layer-3 switches running legacy IGP configs

Analyst note

Open 520/udp usually marks a router/L3 device running legacy RIP. On a non-router it is anomalous; verify the authentication posture and keep it off internet-facing interfaces.