537

Port 537/tcp is registered with IANA under the service name nmsp ("Networked Media Streaming Protocol"), but no RFC, public protocol specification, or documented software implementation ties any real service to this assignment, so an open port 537 should not be exposed to the public internet and any sighting is worth confirming rather than assuming benign.

The IANA registry lists 537 as dual-registered on TCP and UDP under the name nmsp, assignee Paul_Santinelli_Jr, with a blank Reference field and no recorded RFC. This is a bare name-and-description registration — the kind IANA accepted historically without a companion standards document — not evidence of an active protocol.

Nmap's nmap-services frequency file records 537/tcp at exactly 0.000000 (sampled, not observed open, in Nmap's scan corpus) and 537/udp at a low but nonzero 0.000774. Targeted searches for vendor documentation, forum threads, or malware write-ups naming an application that uses port 537 turned up nothing credible as of an August 2026 search.

Because no legitimate deployed service or malware family is documented for this port, and the registration itself has stood unused for decades, a responsive port 537 is best treated as an anomaly to investigate rather than an expected or routine finding.

Exposure

No documented software or protocol implementation uses port 537/tcp; treat any open instance as unexpected and worth investigating rather than as an expected media-streaming service [Likely] — nmap-services (the cached registry snapshots context), IANA registry.

Malware/trojan association

No credible source documents a specific trojan or malware family using port 537 as of an August 2026 search [Unknown].

Scan prevalence

Nmap's nmap-services corpus records 537/tcp at an open-frequency of exactly 0.000000 (sampled, not merely absent) and 537/udp at 0.000774, consistent with a registered-but-effectively-unused port [Confirmed] — nmap-services (svn.nmap.org/nmap/nmap-services).

Notable CVE

None found tied to port 537 as of an August 2026 search.

IANA assignment

nmsp — "Networked Media Streaming Protocol"; reference (blank — no RFC cited in IANA registry); assignee Paul_Santinelli_Jr; dual-registered 537/tcp + 537/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nmsp 537/tcp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nmsp 537/tcp

Prevalence

nmap-services open-frequency 537/tcp = 0.000000 (sampled, real zero reading); 537/udp = 0.000774 [Confirmed] — nmap-services (svn.nmap.org/nmap/nmap-services)

Related ports

536/tcp opalis-rdv and 538/tcp gdomap are the neighboring system-range IANA registrations (unrelated assignees, no shared purpose); RTSP (554) and MMS (1755) are the better-known, unrelated media-streaming protocols on other ports

[Confirmed re: neighbor registrations] — the IANA Service Name and Transport Protocol Port Number Registry

Primary use

registered name/description only; no RFC or public spec verifying an implemented protocol

Other/unofficial uses

none documented in available sources [Unknown]

Security implications

no documented legitimate application or malware family tied to this port; blank IANA reference and near-zero scan frequency make an open 537/tcp an anomaly to investigate

Typically seen on

not documented in available sources; no known deployments identified [Unknown]

Analyst note

An open port 537/tcp has no confirmed legitimate use in current sources; verify against internal asset inventory before dismissing it as routine.

Port 537/udp is IANA-registered for nmsp (Networked Media Streaming Protocol), but the assignment carries no RFC or reference document and no known widely-deployed implementation was found, so it should not be expected on a production host — any traffic on it is worth investigating rather than assumed to be legitimate internal or public-facing service traffic.

IANA registers nmsp in parallel on both 537/tcp and 537/udp to assignee Paul Santinelli Jr., but leaves the Reference and Registration Date columns blank — an unusually thin entry for a formally assigned service name. A web search for vendor documentation, blog posts, forum or support threads, and game/P2P client documentation naming software that generates traffic under the nmsp name or on port 537 turned up nothing.

Measured prevalence supports the same picture: the site's port-data corpus (built from nmap-services) records an open-frequency of about 0.077% for 537/udp and exactly 0 for 537/tcp — a real sampled reading of "not observed open," not a gap in the data. Scanning activity seen against the port is light and low-concern.

Exposure

Anomalous — no documented implementation or vendor software was found for NMSP; treat observed traffic as unexpected and worth investigating rather than routine.

Scanning activity

SANS Internet Storm Center's port-537 page shows only light, low-volume scanning with a green (low-concern) rating and no listed CVEs or user comments, as of an August 2026 check [Likely] — https://isc.sans.edu/data/port/537

CVE / malware

No CVE is recorded against 537/udp and no credible source ties the port to a specific malware family, as of an August 2026 search [Unknown]

IANA assignment

nmsp — "Networked Media Streaming Protocol"; reference (blank — no RFC cited); assignee Paul Santinelli Jr.; dual-registered 537/tcp + 537/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nmsp 537/udp

Range class

system/registered (537 falls in the 0–1023 well-known range per the registry's "system" designation) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nmsp 537/udp

Prevalence

nmap-services open-frequency 537/udp ≈ 0.000774 (~0.08%); 537/tcp = 0 (sampled, not observed open) [Confirmed] — this site's own tooling

Related ports

neighboring system-range assignments in the low 500s; no specific functional relatives identified [Unknown]

Primary use

formally registered name for "Networked Media Streaming Protocol"; no published protocol specification or documented implementation was located

Other/unofficial uses

none found — no vendor, forum, or blog source names software using this port [Unknown]

Security implications

light, low-concern scanning traffic only; no listed CVEs; no confirmed malware association

Typically seen on

not typically seen; an unexpected/anomalous finding on any host [Unknown]

Analyst note

A registered name with no documented protocol or implementation — treat an open 537/udp as worth investigating rather than assuming a known legitimate service.