522

Port 522/udp carries ULP, a User Locator Service reported to track and locate active users in collaborative applications such as Microsoft NetMeeting; it is a legitimate but legacy service that should stay restricted to trusted networks rather than be exposed to the public internet.

IANA registers 522 as a dual TCP/UDP entry under the bare service name "ulp" ("ULP"), assigned to Max Morris, with the Reference field left blank — no RFC or vendor specification is cited in the registry row itself.

A live, port-specific description at auditmypc.com (not just a repeated aggregator label) characterizes ULP as a "User Locator Service" used by collaborative apps to track and locate active users, naming NetMeeting as an example, and warns that it "provides valuable user info for user-level attacks" and should not be allowed across untrusted networks without encryption. This is a third-party characterization rather than a formally published IANA protocol spec, so treat the mechanism as reported, not confirmed.

nmap-services records an open-frequency of about 0.05% for 522/udp and roughly 0.001% for 522/tcp — both low but nonzero, consistent with occasional scanner or background traffic rather than a widely deployed service. NetMeeting itself is a long-discontinued Microsoft product, so any live 522/udp traffic today is more plausibly legacy misconfiguration or scan noise than active ULP use.

Exposure

Reported as a legitimate collaborative-session locator service that the sourced description explicitly says should not be allowed across untrusted networks without encryption; keep it restricted to trusted/internal networks rather than the public internet.

Notable association

Historically tied to Microsoft NetMeeting's User Locator Service for finding active collaboration users, per auditmypc.com and NetMeeting-era firewall-configuration documentation.

Malware/CVE

No CVE tied specifically to 522/udp is recorded in the NVD as of an August 2026 search; auditmypc.com's port-522 page carries no positive virus/trojan flag for this port, supporting a negative malware association without being a comprehensive clearance.

Scanning behavior

UDP scanning of 522 is inherently less reliable than TCP scanning of the same number, since an open UDP port is typically inferred only from the absence of an ICMP port-unreachable reply rather than a positive handshake.

IANA assignment

ulp — "ULP"; reference (blank — no RFC cited in IANA registry); assignee Max Morris; dual-registered 522/tcp + 522/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ulp 522/udp

Range class

well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ulp 522/udp

Prevalence

nmap-services open-frequency 522/udp ≈ 0.000511 (~0.05%); 522/tcp ≈ 0.000013 (~0.001%) [Confirmed] — this site's own tooling

Related ports

522/tcp (same "ulp" IANA registration, dual tcp/udp); NetMeeting-era docs also reference TCP 389, 1503, 1720, 1731 alongside dynamic upper-range UDP ports for related collaboration traffic, though those are not part of the 522 registration itself

[Likely] — http://netmeetings.info/firewallportmethod.htm

Primary use

Registered to the service name "ulp"; a live, port-specific third-party description (auditmypc.com) characterizes it as a User Locator Service used by collaborative apps (e.g. NetMeeting) to track/locate active users; no IANA-published RFC or spec confirms the mechanism [Confirmed registration / Likely protocol description] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=522, https://www.auditmypc.com/tcp-port-522.asp

Other/unofficial uses

none identified beyond the NetMeeting association in an August 2026 search [Unknown]

Security implications

sourced description warns against exposure across untrusted nets without encryption; no confirmed malware/CVE association as of an August 2026 search; UDP scanning of this port is inherently less reliable than TCP scanning (inferred from absence of ICMP unreachable) [Likely/Unknown/Confirmed methodology note]

Typically seen on

legacy Microsoft NetMeeting or other collaborative-session hosts; a discontinued-product association, so current sightings likely reflect scanner noise or misconfiguration [Likely]

Analyst note

522/udp has an IANA registration but a third-party source, not IANA, describes what ULP does; treat NetMeeting/collaborative-locator traffic as the likely explanation for any historical sighting, but current unexplained traffic on a modern network is more plausibly scan noise or a legacy leftover, and should not be exposed to the public internet.