524

Port 524/tcp is registered with IANA as ncp with the description "NCP" (the same service name and description are registered on 524/udp), an assignee and contact of [Don_Provan_2], and a blank reference field. It carries Novell's NetWare Core Protocol, the packet-based client/server RPC framework for file, print, directory, clock-synchronization, messaging, and remote-command services. NCP originally rode IPX/SPX (server socket 0x0451, IPX packet type 17), but the TCP/IP implementation (NCP-over-IP) has been available since 1991 and uses TCP and UDP 524, relying on SLP for name resolution; NCP provides its own session control, sequence numbering, and error checking. Novell eDirectory uses NCP to synchronize directory data between servers, and because eDirectory can be configured to listen on ports other than 524 on multi-instance hosts, a 524 assumption is only the default. It is used by NetWare 5+, Open Enterprise Server (the Linux-based successor from 2004), and clients such as the Novell Client for Windows/Linux and ncpfs. The IANA reference field is blank. Security-wise, NetWare 2.x/3.x transmitted a weak 16-byte password hash over IPX in clear (sniffable and offline-crackable) while NetWare 4+ added RSA public-key zero-knowledge authentication, and denial-of-service CVEs exist — CVE-2006-4520 (crafted fragmented NCP requests crash eDirectory 8.7.3 before SP9 and 8.8.x before 8.8.1 FTF2) and CVE-2010-4327 (a malformed NCP FileSetLock request to port 524 hangs eDirectory 8.8.5); mitigations include vendor patches, enabling NCP packet signature against tampering and replay, and firewalling 524, while nmap's ncp-serverinfo script can enumerate server name, tree name, OS version, and mounts. General NetWare support ended (NetWare 6.5 reached end of life on 7 March 2010; Novell became Micro Focus). For an analyst, an open 524 identifies a NetWare/eDirectory/Open Enterprise Server host; fingerprint it with ncp-serverinfo, confirm packet signature is enabled, and restrict it to management segments.

IANA assignment

ncp — "NCP" (524/tcp and 524/udp); reference (blank — no RFC cited in IANA registry); assignee/contact [Don_Provan_2]; dual-registered 524/tcp + 524/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000213 (de-facto) [Well-established] — nmap-services file

Related ports

SLP (name resolution); broader Novell port set

Primary use

Novell client/server protocol for file/print/directory services (NCP-over-IP)

Other/unofficial uses

eDirectory inter-server synchronization; ncpfs [Well-established]

Security implications

NetWare 2.x/3.x weak cleartext password hash (sniffable); DoS CVE-2006-4520 and CVE-2010-4327 (eDirectory); mitigate via patches, NCP packet signature, firewalling; ncp-serverinfo recon

Typically seen on

Novell NetWare / Open Enterprise Server / eDirectory servers

Analyst note

An open 524 identifies a NetWare/eDirectory/OES host; fingerprint with ncp-serverinfo, confirm packet signature is enabled, restrict to management segments — a niche but identifiable legacy-enterprise system.

Port 524/udp carries NCP, the NetWare Core Protocol, Novell's proprietary client-server protocol for NetWare and eDirectory networks; it should stay internal-only rather than be exposed to the public internet. NCP handles file access, print services, directory/login authentication, and general resource management between NetWare clients and servers.

IANA registers 524 as ncp ("NCP") on both TCP and UDP, with assignee and contact both listed as Don_Provan_2 and a blank Reference field — no RFC is cited for this assignment. No registration or modification date is published in the registry entry itself.

The TCP/IP implementation of NCP uses TCP and UDP port 524 and relies on SLP for name resolution. Novell's own "Ports and Protocols used by NetWare 5.X and 6.X" technical document does divide the work between the two transports: it lists "TCP 524 - NCP Requests" and "UDP 524 - NCP for time synchronization", each with a high source port in the 1024-65535 range. So on the UDP side specifically, the documented role is time synchronization rather than general NCP request traffic. Because NCP is a Novell-proprietary protocol, essentially all software generating traffic here traces back to Novell's own server and client stack, including successors under later Micro Focus and OpenText branding as Novell's NetWare/eDirectory line changed ownership.

Measured open-frequency for 524/udp in the repo's nmap-services-derived corpus is approximately 0.000873 (about 0.087%), indicating the port is rarely found open in general internet scans — consistent with a legacy enterprise protocol that belongs on internal networks rather than the public internet.

Exposure

NCP is a legacy, largely cleartext protocol used for file, print, and directory-authentication traffic; it should be restricted to trusted internal networks and never exposed to the public internet.

Notable CVE

none found specific to 524/udp as of an August 2026 search.

Malware association

no credible malware or trojan association for 524/udp was found as of an August 2026 search.

Legacy protocol risk

a third-party port-lookup aggregator (whatportis.com) describes NCP as a legacy protocol whose traffic can be readable on-path and recommends isolating or migrating any exposed legacy NCP servers; this is a secondary aggregator characterization, not a primary vendor or CVE-backed finding, so it is noted here only as a hedged observation.

IANA assignment

ncp — "NCP"; reference (blank — no RFC cited); assignee Don_Provan_2; dual-registered 524/tcp + 524/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ncp 524/udp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ncp 524/udp

Prevalence

nmap-services open-frequency 524/udp ≈ 0.000873 (~0.087%); 524/tcp ≈ 0.000213 [Confirmed] — this site's own tooling

Related ports

524/tcp (same NCP service, dual-registered); other Novell/eDirectory service ports

Primary use

NetWare Core Protocol (NCP) — Novell's proprietary file/print/directory-service protocol for NetWare and eDirectory networks; the TCP/IP implementation uses TCP and UDP port 524 and relies on SLP for name resolution, and Novell's own port list assigns UDP 524 to NCP time synchronization while TCP 524 carries NCP requests [Confirmed] — https://support.novell.com/docs/Tids/Solutions/10013531.html, https://handwiki.org/wiki/NetWare_Core_Protocol, https://en.wikipedia.org/wiki/NetWare_Core_Protocol

Other/unofficial uses

none identified beyond the Novell NCP ecosystem

Security implications

legacy, largely cleartext enterprise protocol; should remain internal-only; no CVE or malware association specific to 524/udp found as of an August 2026 search

Typically seen on

legacy Novell NetWare / eDirectory servers and their Novell Client software

Analyst note

A responsive 524/udp most likely indicates a legacy Novell NetWare/eDirectory server; it should not be reachable from the public internet given its cleartext, enterprise-internal design.