523
Summary
- // typical exposure
- Internal-only — DAS is a DB2 administrative control-plane listener meant for trusted management access, not public reach, and hardening guidance recommends restricting or relocating it rather than exposing it externally.
- // common applications
- IBM DB2 Administration Server (DAS)DB2 Control CenterDB2 Configuration Assistant Traffic on this port is most often IBM DB2's Administration Server (DAS) handling remote admin connections from DB2 client tools; IBM's own documentation confirms this as the port's exclusive reserved use, though DAS has been deprecated since DB2 Version 9.7.
- // analyst note
- A responsive 523 signals a DB2 DAS listener, most likely on a legacy DB2 host; verify it is restricted to trusted admin networks rather than internet-facing, and cross-reference with DB2 instance ports (e.g. 50000) for the full deployment picture.
- // if you see it open
- DAS is a DB2 administrative control-plane service and should be restricted to trusted management networks rather than exposed to the public internet. A responsive 523 is a recognized DB2 DAS fingerprint — Nmap ships a dedicated db2-das-info NSE script to enumerate it — and CIS/Tenable hardening guidance for DB2 10 on Linux recommends moving DB2 off well-known ports like 523 to reduce discoverability. The DAS has been deprecated by IBM since DB2 Version 9.7, so a live 523 today is more a legacy signature than a current default. No CVE specific to the DAS listener and no malware/trojan association were found as of an August 2026 search.
About port 523/tcp.
Port 523/tcp carries the IBM DB2 Administration Server (DAS), a background listener that DB2 client tools use for remote administrative tasks; it should stay internal-only rather than face the public internet.
IANA registers 523 as ibm-db2 (dual-registered on TCP and UDP) with description "IBM-DB2," assignee [Juliana_Hsu], and a blank reference field. IBM's own support documentation states the DB2 database manager reserves TCP port 523 exclusively for communication with the DAS, which client-side tools such as Control Center and the Configuration Assistant use to discover DB2 instances on a network, export/import configuration profiles, and schedule remote administrative jobs.
IBM documentation also states the DAS has been deprecated since DB2 Version 9.7 and may be removed in a future release, so a listener on 523 today is more associated with legacy DB2 installations than current default setups — modern DB2 instance connections typically default to port 50000 instead.
Because 523 identifies a DB2 administrative listener rather than an ordinary data-path port, security tooling treats a responsive 523 as a higher-value fingerprinting target: Nmap ships a dedicated db2-das-info NSE script specifically to enumerate DAS services on this port, and hardening guidance recommends moving DB2 off well-known ports like 523 to reduce discoverability.
- Exposure
- DAS is an administrative control-plane service for DB2 and should be restricted to trusted management networks, not exposed to the public internet [Likely] — https://www.ibm.com/support/pages/db2-db2-server-tcpip-port-numbers
- Fingerprinting risk
- a responsive 523 is a recognized DB2 DAS signature; Nmap's
db2-das-infoNSE script exists specifically to enumerate it [Confirmed] — https://nmap.org/nsedoc/this site's own tooling - Hardening guidance
- CIS/Tenable benchmark guidance for IBM DB2 10 on Linux recommends moving DB2 off default well-known ports (including 523) to reduce discoverability [Likely] — https://www.tenable.com/audits/items/CIS_IBM_DB2_10_v1.1.0_Level_2_OS_Linux.audit:3bc7325aee5f99e7ef602cb617367041
- CVE/malware
- no CVE specific to the DAS listener on port 523 and no malware/trojan association was found as of an August 2026 search [Unknown]
- IANA assignment
ibm-db2— "IBM-DB2"; reference (blank); assignee[Juliana_Hsu]; dual-registered 523/tcp + 523/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ibm-db2 523/tcp- Range class
- registered/system (0–1023 system range per the nmap-services frequency data) [Confirmed] — this site's own tooling
- Prevalence
- nmap-services open-frequency 523/tcp = 0.000113; 523/udp = 0.000461 (per-transport figures from this site's own tooling) [Confirmed] — this site's own tooling
- Related ports
- 50000/tcp (modern default DB2 instance connection port) [Likely] — https://www.ibm.com/support/pages/db2-db2-server-tcpip-port-numbers
Primary use
IBM DB2 Administration Server (DAS) — remote administrative listener for DB2 client tools (Control Center, Configuration Assistant): instance discovery, config profile export/import, remote job scheduling
Other/unofficial uses
none identified beyond DB2 DAS as of an August 2026 search [Unknown]
Security implications
DAS is an administrative control-plane service; deprecated since DB2 9.7; a responsive 523 is a recognized DB2 fingerprint (Nmap db2-das-info); hardening guidance recommends moving DB2 off well-known ports; no CVE or malware association found for the port itself [Likely/Confirmed mixed — see bullets above]
Typically seen on
legacy/older IBM DB2 server installations running the (now-deprecated) DAS component
- Analyst note
- A responsive 523 signals a DB2 DAS listener, most likely on a legacy DB2 host; verify it is restricted to trusted admin networks rather than internet-facing, and cross-reference with DB2 instance ports (e.g. 50000) for the full deployment picture.
About port 523/udp.
Port 523/udp carries IBM's DB2 Administration Server (DAS) discovery service; it should stay internal-only rather than exposed to the public internet, because the service responds to profile-export requests without authentication.
IANA registers 523 as ibm-db2 — "IBM-DB2" — on both TCP and UDP, assignee Juliana Hsu (IBM), with a blank Reference column; no RFC backs the assignment. The registry entry alone does not describe the wire protocol.
The concrete, documented real-world behavior comes from Nmap's db2-das-info script: a client sends a DAS profile-export request to UDP (or TCP) 523, and the DB2 Administration Server replies with the host's profile — hostname, IP addresses, database aliases, and instance names — with no credentials required. No independent sighting of software other than the IBM DB2 Administration Server surfaced on this port in an August 2026 search, so this entry claims nothing beyond the DB2 DAS behavior above and the bare registry assignment.
Measured open-frequency in the repo's nmap-services-derived dataset is low for both transports: 523/udp ≈ 0.000461 (~0.046%) and 523/tcp ≈ 0.000113 (~0.011%), consistent with a niche administrative service rather than a broadly deployed one.
- Exposure
- the DB2 DAS profile-export function answers unauthenticated, disclosing hostname, IP addresses, database aliases, and instance names to any remote client that asks [Likely] — nmap.org db2-das-info.html.
- Recon risk
- an open, responsive 523/udp is best treated as a DB2 host-fingerprinting and reconnaissance signal rather than routine background traffic.
- CVE
- no CVE specific to this port or the DAS profile-export function was found as of an August 2026 search.
- Malware/trojan
- no confirmed malware or trojan association as of an August 2026 search; the auditmypc.com port-523 detail page did not return port-specific content in this search, so no verdict is drawn from it either way.
- IANA assignment
ibm-db2— "IBM-DB2"; reference (blank — no RFC cited in IANA registry); assignee Juliana Hsu; dual-registered 523/tcp + 523/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ibm-db2 523/udp- Range class
- well-known (0–1023) [Confirmed] — this site's own tooling
- Prevalence
- nmap-services open-frequency 523/udp ≈ 0.000461 (~0.046%); 523/tcp ≈ 0.000113 (~0.011%) [Confirmed] — this site's own tooling
- Related ports
- 50000/tcp (DB2 default connection port); other database admin/discovery ports
Primary use
IBM DB2 Administration Server (DAS) profile-export/discovery — returns host profile (hostname, IPs, DB aliases, instance names) to an unauthenticated requester
Other/unofficial uses
none independently confirmed; no non-DB2 sighting on this port was found in an August 2026 search [Unknown]
Security implications
unauthenticated DAS profile export discloses host/instance configuration details; reconnaissance/information-disclosure exposure rather than a documented remote-code exploit; no CVE located
Typically seen on
hosts running IBM DB2 with the Administration Server enabled
- Analyst note
- An open 523/udp responding to DAS profile-export requests should be restricted to trusted DB2 management networks; unauthenticated responses are a fingerprinting and information-disclosure signal worth investigating.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ibm-db2 | UDP | — | 0.05% |
| ibm-db2 | TCP | — | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.