524

Port 524/tcp is registered with IANA as ncp with the description "NCP" (the same service name and description are registered on 524/udp) and blank assignee, contact, and reference fields. It carries Novell's NetWare Core Protocol, the packet-based client/server RPC framework for file, print, directory, clock-synchronization, messaging, and remote-command services. NCP originally rode IPX/SPX (server socket 0x0451, IPX packet type 17), but the TCP/IP implementation (NCP-over-IP) has been available since 1991 and uses TCP and UDP 524, relying on SLP for name resolution; NCP provides its own session control, sequence numbering, and error checking. Novell eDirectory uses NCP to synchronize directory data between servers, and because eDirectory can be configured to listen on ports other than 524 on multi-instance hosts, a 524 assumption is only the default. It is used by NetWare 5+, Open Enterprise Server (the Linux-based successor from 2004), and clients such as the Novell Client for Windows/Linux and ncpfs. The IANA reference field is blank. Security-wise, NetWare 2.x/3.x transmitted a weak 16-byte password hash over IPX in clear (sniffable and offline-crackable) while NetWare 4+ added RSA public-key zero-knowledge authentication, and denial-of-service CVEs exist — CVE-2006-4520 (crafted fragmented NCP requests crash eDirectory 8.7.3 before SP9 and 8.8.x before 8.8.1 FTF2) and CVE-2010-4327 (a malformed NCP FileSetLock request to port 524 hangs eDirectory 8.8.5); mitigations include vendor patches, enabling NCP packet signature against tampering and replay, and firewalling 524, while nmap's ncp-serverinfo script can enumerate server name, tree name, OS version, and mounts. General NetWare support ended (NetWare 6.5 reached end of life on 7 March 2010; Novell became Micro Focus). For an analyst, an open 524 identifies a NetWare/eDirectory/Open Enterprise Server host; fingerprint it with ncp-serverinfo, confirm packet signature is enabled, and restrict it to management segments.

IANA assignment

ncp — "NCP" (524/tcp and 524/udp); reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 524/tcp + 524/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000213 (de-facto) [Well-established] — nmap-services file

Related ports

SLP (name resolution); broader Novell port set

Primary use

Novell client/server protocol for file/print/directory services (NCP-over-IP)

Other/unofficial uses

eDirectory inter-server synchronization; ncpfs [Well-established]

Security implications

NetWare 2.x/3.x weak cleartext password hash (sniffable); DoS CVE-2006-4520 and CVE-2010-4327 (eDirectory); mitigate via patches, NCP packet signature, firewalling; ncp-serverinfo recon

Typically seen on

Novell NetWare / Open Enterprise Server / eDirectory servers

Analyst note

An open 524 identifies a NetWare/eDirectory/OES host; fingerprint with ncp-serverinfo, confirm packet signature is enabled, restrict to management segments — a niche but identifiable legacy-enterprise system.