526

Port 526/tcp carries tempo, described in the IANA registry as "newdate"; it is a legacy Unix date/time-negotiation service with no evidence of current deployment, so it should never be exposed to the public internet and a response on it today is best treated as an anomaly.

The IANA Service Name and Transport Protocol Port Number Registry lists 526 as dual-registered on both TCP and UDP for the service name tempo, description "newdate," with no assignee and no reference (RFC) recorded. The blank reference field is the registry's actual state, not an omission on this page.

Historically, tempo traces to the same early-Unix era as timed (port 525) and other now-obsolete time/date-negotiation daemons. RFC 1340, the historical "Assigned Numbers" document, lists the identical name/port/description as background corroboration, though IANA itself cites no RFC against this specific assignment.

No vendor documentation, blog post, or forum thread was found describing active current use of port 526 for any purpose. A distinct, unrelated modern product, Grafana Tempo (a distributed tracing backend), shares the "Tempo" name but uses its own ports — its HTTP server defaults to 3200 and its OTLP gRPC receiver to 4317 — and has no connection to this IANA assignment.

Measured against the site's port-frequency dataset (built from nmap-services), 526/tcp shows an open-frequency of 0.000013 (about 0.0013%), and 526/udp shows 0.000346 (about 0.035%) — both consistent with a service that is rarely if ever seen open rather than one in active deployment.

Exposure

Anomalous — the tempo/newdate service is a legacy Unix-era assignment with no evidence of current legitimate deployment; treat an open 526/tcp as unexpected and worth investigating.

Malware association

None found as of an August 2026 search; no CVE is recorded in the NVD as of 2026-08 for this port.

Fingerprint value

A live listener here is unusual enough to suggest a nonstandard or custom service, a decoy, or a misconfigured legacy host rather than expected infrastructure.

IANA assignment

tempo — "newdate"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 526/tcp + 526/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry tempo 526/tcp

Range class

well-known/system (0–1023) [Confirmed] — this site's own tooling

Prevalence

nmap-services open-frequency 526/tcp = 0.000013 (~0.0013%); 526/udp = 0.000346 (~0.035%) [Confirmed] — this site's own tooling

Related ports

525/tcp and 525/udp (timed) — same early time/date-negotiation service lineage

Primary use

legacy Unix date/time-negotiation service ("newdate"), lineage related to timed (port 525); background corroboration in RFC 1340 (historical "Assigned Numbers," no RFC defines the protocol itself)

Other/unofficial uses

none found; no evidence of current deployment [Unknown]

Security implications

no CVE or malware association found as of an August 2026 search; essentially never legitimately open today, so an open port functions mainly as a fingerprint/anomaly signal [Unknown/Likely]

Typically seen on

legacy/historical Unix hosts, if any remain; otherwise anomalous [Unknown]

Name collision (not a related port)

Grafana Tempo, a modern distributed-tracing backend, shares only the name; its HTTP server defaults to port 3200 and its OTLP gRPC receiver to 4317, neither related to this assignment [Confirmed] — https://grafana.com/docs/tempo/latest/configuration/

Analyst note

An open 526/tcp is statistically rare (measured frequency ~0.0013%) and has no documented current legitimate use; investigate rather than assume routine traffic.

Port 526/udp carries the historic Unix tempo (newdate) time/date service; no modern software or vendor for it is identifiable, so it should not be exposed to the public internet and a responsive instance is worth treating as an anomaly.

IANA's Service Name and Transport Protocol Port Number Registry lists 526/udp as tempo with description "newdate," dual-registered alongside 526/tcp under the same name. The Assignee and Reference columns are blank, and no RFC documenting a tempo/newdate protocol could be located, so the registration is essentially a bare name-and-description entry from the Unix service-naming era rather than a specified, documented protocol.

The third-party mirror consulted carries only the same name/description pair the registry does — tempo / newdate — and adds no account of the protocol's behavior. Background corroboration comes instead from RFC 1340, the historical "Assigned Numbers" document, which lists tempo 526/tcp newdate and tempo 526/udp newdate verbatim; IANA itself cites no reference against the assignment, and no RFC defines the protocol. The port does not appear in Wikipedia's well-known-ports table (which skips from 525 to 530), suggesting it was never a notable or widely deployed assignment even in its own era.

No modern vendor, client, or maintained implementation of this service was found in an August 2026 web search, and no CVE tied to this port is recorded in the NVD as of that search. Because the underlying service is effectively defunct, legitimate traffic on 526/udp today is unlikely; measured openness is low but non-zero.

Exposure

should never be internet-facing; the service is obsolete and has no identifiable modern legitimate use.

Malware/trojan association

unconfirmed — the port-specific verdict page could not be retrieved via automated fetch, and no other source confirmed an association as of an August 2026 search.

Anomaly signal

a responsive 526/udp on a modern network is unusual and warrants investigation as a legacy leftover, misconfiguration, or decoy rather than expected infrastructure.

IANA assignment

tempo — "newdate"; reference (blank); assignee (blank); dual-registered 526/tcp + 526/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry tempo 526/udp

Range class

well-known/system (0–1023) [Confirmed] — this site's own tooling (526 range: "system")

Prevalence

nmap-services open-frequency 526/udp = 0.000346 (~0.035%); 526/tcp = 0.000013 [Confirmed] — this site's own tooling

Related ports

526/tcp (same dual registration, same tempo/newdate name)

Primary use

legacy Unix tempo/newdate time/date service; listed in RFC 1340 (historical "Assigned Numbers") as background corroboration, but no RFC defines the protocol and IANA cites no reference

Other/unofficial uses

none identified; absent from Wikipedia's List of TCP and UDP port numbers [Unknown, confirmed absence from that listing] — https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Security implications

no CVE recorded in the NVD as of an August 2026 search; malware/trojan association unconfirmed (port-specific verdict page not retrievable)

Typically seen on

legacy/obsolete Unix hosts historically; otherwise anomalous on a modern network [Likely]

Analyst note

A responsive 526/udp has no identifiable modern legitimate purpose; treat it as a legacy artifact, misconfiguration, or possible decoy and investigate rather than assume normal service.