521
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — RIPng (RFC 2080) is a UDP-only routing protocol, so a listener on 521/tcp specifically has no defined protocol role and falls outside normal RIPng deployment.
- // analyst note
- RIPng is a legitimate but UDP-only IPv6 routing protocol; because it has no defined TCP mode, an open 521/tcp is unusual and worth investigating rather than assuming standard routing traffic.
- // if you see it open
- No CVE or named malware family is documented specifically for 521/tcp as of an August 2026 search. RIPng (RFC 2080) is defined as a UDP-only protocol, so a responsive TCP/521 listener is outside normal operation and should be treated as anomalous rather than routine routing traffic.
About port 521/tcp.
Port 521/tcp is formally registered with IANA as ripng, but the RIPng routing protocol that name refers to actually operates over UDP, not TCP — a live listener on 521/tcp is not part of normal RIPng deployment and should be treated as anomalous rather than expected routing infrastructure.
IANA lists port 521 under the service name ripng for both tcp and udp, with assignee Robert E Minnear and a blank Reference column. RFC 2080 (Malkin & Minnear, January 1997) defines RIPng for IPv6 and specifies UDP port 521 as the protocol's operating port; the RFC defines no TCP mode, so the tcp/521 registry row is a dual/paper assignment rather than an implemented service.
RIPng is a distance-vector routing protocol that lets routers on a local network segment exchange IPv6 routing-table updates, serving as the IPv6-era successor to classic RIP. Documented implementations — Oracle Solaris's in.ripngd daemon and router/firewall platforms such as WatchGuard Fireware — all run on UDP/521; no vendor documentation or community report describes a TCP/521 RIPng service.
The number 521 is unrelated to Cloudflare's HTTP 521 "Web server is down" error code, a naming coincidence that surfaces often in generic searches but has no bearing on TCP/UDP port 521 traffic. In the nmap-services scan corpus, 521/tcp measured an open-frequency of exactly 0 (sampled, not observed open), while 521/udp measured roughly 0.07% — consistent with RIPng being a UDP-only protocol in practice.
- Exposure
- Anomalous — RIPng is defined as UDP-only by RFC 2080, so a responsive 521/tcp listener falls outside normal protocol operation and warrants investigation.
- Malware note
- auditmypc.com's port 521 page carries no virus/trojan verdict for this port; no malware family is documented tied to 521/tcp as of an August 2026 search.
- Best practice
- If RIPng routing is required, run it on UDP/521 within trusted internal network segments; treat any TCP/521 response as worth investigating rather than assuming routine routing traffic.
- IANA assignment
ripng— "ripng"; reference (blank — no RFC cited in registry); assignee Robert E Minnear; dual-registered 521/tcp + 521/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ripng 521/tcp- Range class
- well-known (0-1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 521/tcp = 0.000000 (sampled, not observed open); 521/udp ≈ 0.000708 [Confirmed] — this site's own tooling
- Related ports
- 521/udp (the operative RIPng port); 520/udp (classic RIP, RIPng's IPv4-era predecessor) [Confirmed/Likely]
Primary use
RIPng (RIP next generation), the IPv6 distance-vector routing protocol defined by RFC 2080, which operates over UDP/521; the TCP/521 registry entry exists formally but has no defined protocol role
Other/unofficial uses
none confirmed; no vendor or community source documents a TCP/521 service distinct from RIPng
Security implications
no CVE or malware family documented for 521/tcp as of an August 2026 search; RIPng itself is UDP-only per RFC 2080, so a TCP/521 listener falls outside normal operation
Typically seen on
routers running RIPng on UDP/521 (e.g. Oracle Solaris in.ripngd, WatchGuard Fireware); TCP/521 not typically seen in legitimate deployments
- Analyst note
- RIPng is a legitimate but UDP-only IPv6 routing protocol; because it has no defined TCP mode, an open 521/tcp is unusual and worth investigating rather than assuming standard routing traffic.
About port 521/udp.
Port 521/udp carries RIPng — the IPv6 version of the Routing Information Protocol, defined in RFC 2080 — and it should stay strictly on internal router-to-router links rather than ever facing the public internet.
IANA registers port 521 for ripng on both tcp and udp, assignee Robert E. Minnear, with a blank Reference field. In practice udp/521 is the transport actually used, since RIPng exchanges routing updates as UDP datagrams rather than TCP streams; the tcp/521 registration exists on paper but is not how the protocol is deployed.
RIPng is a distance-vector interior gateway protocol: routers send periodic and triggered updates carrying IPv6 route prefixes and hop-count metrics, normally addressed to the link-local multicast group ff02::9 on each routed interface. It is the IPv6-era successor to classic RIP, keeping RIP's simplicity while replacing IPv4 route entries with IPv6 ones.
Because RIPng is meant to run only between routers on directly connected internal links, a udp/521 listener reachable from outside a routed network is unusual. It is worth investigating as a misconfiguration, a stray lab/test device, or router mismanagement rather than a normal internet-facing service.
- Exposure
- RIPng is designed for router-to-router use on internal, directly connected links; udp/521 reachable from the public internet is a misconfiguration, not a legitimate deployment [Likely] — RFC 2080.
- Scanning difficulty
- UDP's connectionless nature makes udp/521 harder to enumerate with naive scans than a TCP service, per general UDP-scanning guidance [Likely] — https://nmap.org/book/scan-methods-udp-scan.html
- IANA assignment
ripng— description "ripng"; reference (blank — none cited in IANA registry); assignee Robert E. Minnear; dual-registered 521/tcp + 521/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ripng 521/udp- Range class
- system/well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ripng 521/udp
- Prevalence
- nmap-services open-frequency 521/udp = 0.000708 (~0.07%); 521/tcp = 0 (sampled, not observed open) [Confirmed] — this site's own tooling
- Related ports
- 520/udp (RIP for IPv4); contrast modern IPv6 IGPs (OSPFv3, IS-IS)
Primary use
RIPng, an IPv6 distance-vector interior routing protocol (RFC 2080); routers exchange periodic/triggered route updates as UDP datagrams, typically to link-local multicast ff02::9
Other/unofficial uses
none documented beyond RIPng itself [Confirmed — no other use found]
Security implications
an internal-use-only routing protocol; internet-reachable udp/521 is anomalous and worth investigating; no CVE or malware/trojan association found as of an August 2026 search
Typically seen on
router interfaces running RIPng — Cisco IOS/IOS-XE, Juniper Junos, FRRouting (ripngd), legacy Quagga, VyOS (via FRRouting), WatchGuard Fireware [Likely] — https://www.juniper.net/documentation/us/en/software/junos/rip/rip.pdf, https://frrouting.org/, https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/dynamicrouting/rip_about_c.html
- Analyst note
- RIPng belongs on internal router links only; an internet-facing udp/521 is statistically rare and should be treated as a misconfiguration or anomaly rather than a normal service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ripng | UDP | — | 0.07% |
| ripng | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.