533
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — The netwall registration has no confirmed real-world protocol implementation or software deployment, so a responsive 533/tcp is atypical and worth investigating rather than expected as routine internet-facing, restricted, or internal traffic.
- // analyst note
- An open 533/tcp is unusual given netwall's obsolete status — treat as worth investigating (misconfiguration, scanner, or decoy) rather than routine infrastructure.
- // if you see it open
- netwall is an essentially obsolete, rarely-deployed historical service with no evidence of active current use. No malware or trojan association is documented as of an August 2026 search, and the port is not flagged in current scanning/Shodan writeups as a notable exposure surface. An open 533/tcp is unusual and should be treated as worth investigating.
About port 533/tcp.
Port 533/tcp is registered with IANA as netwall, described only as "for emergency broadcasts"; the protocol is effectively obsolete today and there is no legitimate reason for it to be reachable from the public internet.
The IANA registry lists Andreas Heidemann as both assignee and contact, with a blank Reference field and no registration or modification date recorded. The service is dual-registered on TCP and UDP with identical attributes, but no RFC or other formal specification is cited, so the protocol mechanics beyond the name and description are not documented in the registry itself.
The registry description reads "for emergency broadcasts" and nothing further — it names no operating system, no mechanism and no era, and no source consulted this pass supplies those details either. No third-party software or vendor product is documented as commonly generating traffic on this port; the only association found across sources is the netwall service name itself. This is the same reading the DONE sibling 533/udp publishes off the identical registry row.
Measured open-frequency in the nmap-services corpus is about 0.000013 for 533/tcp (roughly 0.0013% of scanned hosts) and about 0.000461 for 533/udp (roughly 0.046%), both extremely low and consistent with a service that has seen little to no real-world adoption.
- Exposure
- Anomalous — netwall is an obsolete, rarely-deployed historical service; an open 533/tcp is unusual and worth investigating rather than expected infrastructure.
- Malware association
- None. No malware or trojan association for port 533 is documented by any source this entry cites, as of an August 2026 search.
- Scanning exposure
- Not among the ports commonly flagged in current scanning/Shodan writeups as a notable exposure surface, per an August 2026 search.
- Prevalence
- Open-frequency is extremely low (about 0.0013% for TCP, about 0.046% for UDP) in the nmap-services corpus, consistent with minimal real-world deployment.
- IANA assignment
netwall— "for emergency broadcasts"; reference (blank — none cited in registry); assignee/contact Andreas Heidemann; dual-registered 533/tcp + 533/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netwall 533/tcp- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netwall 533/tcp
- Prevalence
- nmap-services open-frequency 533/tcp ≈ 0.000013 (~0.0013%); 533/udp ≈ 0.000461 (~0.046%) [Confirmed] — this site's own tooling
- Related ports
- no closely related cluster documented for this service [Unknown]
Primary use
no RFC or formal specification is cited by IANA, whose description column reads only "for emergency broadcasts"; no confirmed real-world protocol implementation identified
Other/unofficial uses
none documented; no third-party software commonly associated with this port turned up in available sources [Unknown]
Security implications
essentially obsolete/rarely deployed; no documented malware association as of an August 2026 search; not flagged as a notable scanning/exposure target [Likely/Unknown]
Typically seen on
legacy/historical Unix hosts that ran netwall; otherwise anomalous [Likely]
- Analyst note
- An open 533/tcp is unusual given netwall's obsolete status — treat as worth investigating (misconfiguration, scanner, or decoy) rather than routine infrastructure.
About port 533/udp.
Port 533/udp carries the IANA-registered service netwall, listed only as "for emergency broadcasts"; it should not be expected on the public internet, since no confirmed real-world protocol implementation or actively maintained software has been identified using this port today.
IANA registers netwall on both 533/tcp and 533/udp under the same service name, with assignee Andreas_Heidemann and a blank Reference column — no RFC or other formal specification backs the entry. The registration-date field is also blank, so the age of the assignment cannot be dated precisely, though the name has sat in the registry for decades.
No vendor documentation, forum thread, or software project was found describing a specific application that generates traffic on 533/udp. The nmap-services corpus records an open-frequency of about 0.046% for 533/udp (versus roughly 0.0013% for 533/tcp) — occasionally seen open in internet-wide scans, but at a rate consistent with a lightly used or legacy assignment rather than a deployed service.
The one documented anomaly is a SANS Internet Storm Center diary dated 2005-03-19, which reported a scanning spike touching port 533 across many targets from few sources; the handlers stated they did not know what was being scanned for and asked readers to submit packet captures, and no follow-up explanation appears in that source. This is a single dated data point, not an ongoing trend.
- Exposure
- Anomalous — no confirmed legitimate service is known to run on 533/udp today, so a responsive instance warrants investigation rather than routine allowance.
- Registration
- IANA lists
netwall, "for emergency broadcasts," on 533/tcp and 533/udp with no RFC or other reference cited. - Prevalence
- nmap-services open-frequency is about 0.046% for 533/udp, indicating rare but nonzero exposure in internet-wide scans.
- Historical anomaly
- A SANS ISC diary dated 2005-03-19 reported an unexplained scanning spike touching port 533; handlers requested packet captures and no cause was ever published.
- IANA assignment
netwall— "for emergency broadcasts"; reference (blank — no RFC cited); assignee Andreas_Heidemann; dual-registered 533/tcp + 533/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netwall 533/udp- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netwall 533/udp
- Prevalence
- nmap-services open-frequency 533/udp ≈ 0.000461 (~0.046%); 533/tcp ≈ 0.000013 (~0.0013%) [Confirmed] — this site's own tooling
- Related ports
- 533/tcp (same dual IANA registration) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netwall 533/tcp
Primary use
no RFC or formal specification is cited by IANA; no confirmed real-world protocol implementation identified
Other/unofficial uses
none confirmed in available sources [Unknown]
Security implications
no confirmed malware association; one dated (2005-03-19) SANS ISC report of an unexplained scanning spike touching port 533 [Likely] — https://isc.sans.edu/diary/Port+533+spike;+Planned+maintenance+completed;+Java+WebStart+Cross+Platform+Vulnerability,+cont./484
Typically seen on
not established; no confirmed deployment pattern [Unknown]
- Analyst note
- An open 533/udp has no confirmed legitimate current use; treat it as worth investigating rather than expected traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| netwall | UDP | for emergency broadcasts | 0.05% |
| netwall | TCP | for emergency broadcasts | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.