545
Summary
- // typical exposure
- Internal-only — Both service identities tied to 545/tcp — a discontinued Apple QuickTime conferencing server and a Kerberized legacy remote-shell service descended from the r-commands family — are administrative/legacy protocols that were never designed for public-internet reachability.
- // common applications
- Apple QuickTime Conferencing (QTCSrvr)Kerberos ekshell/eklogin (r-commands sui Traffic on this port most likely reflects either legacy Apple QuickTime Conferencing server activity (an informal gloss for IANA's
appleqtcsrvrregistration, not the registry's own wording) or the Kerberized ekshell remote-shell service (per the nmap-services fingerprint); both are largely obsolete, so modern traffic here is more plausibly scanning noise or an anomaly than a live production service. - // analyst note
- An open 545/tcp is rare; check whether the host answers as a QuickTime Conferencing server or a Kerberized remote shell before assuming either — the two source databases name this port differently, and the actual banner resolves which legacy service is present.
- // if you see it open
- Both identities (a discontinued Apple conferencing server; a Kerberized legacy remote-shell service descended from the r-commands family) are administrative/legacy protocols with no legitimate public-internet exposure case. No CVE or malware family found tied to 545/tcp specifically as of an August 2026 search (auditmypc.com 'Virus/Trojan: No' verdict, cited for the negative only). The naming split between IANA and nmap-services is itself a useful fingerprinting signal.
About port 545/tcp.
Port 545/tcp does not have one settled identity: IANA's Service Name and Transport Protocol Port Number Registry lists it as appleqtcsrvr — the registry's Description column holds only that bare string; "Apple QuickTime Conferencing Server" is an informal gloss found on third-party sites, not the registry's own wording — while the nmap-services fingerprint database instead names 545/tcp specifically ekshell, described as "Kerberos encrypted remote shell -kfall." Under either identity it is a legacy, low-prevalence service with no business facing the public internet.
The IANA entry covers both 545/tcp and 545/udp under the single name appleqtcsrvr, assignee Murali_Ranganathan, with a blank Reference column — no RFC backs the assignment, and the registry records no registration or modification date. appleqtcsrvr is tied to Apple's discontinued QuickTime Conferencing server; that link is corroborated only by third-party port-lookup sites, not an Apple primary source.
nmap-services — the empirical port-naming database this site's own prevalence figures are built from — disagrees for the TCP side specifically: it names 545/tcp ekshell, the Kerberized encrypted variant of the old Berkeley r-shell remote-command service (paired with eklogin), rather than appleqtcsrvr. The 545/udp row in the same file keeps appleqtcsrvr. This is a genuine split between two legitimate sources, not an error in either one.
Per this site's own port-data artifact (built from nmap-services), 545/tcp carries an open-frequency of 0.000276 (~0.028%) under the name ekshell; the udp side sits at 0.000478 (~0.048%) under appleqtcsrvr. Both figures are low, consistent with a rarely-open legacy port rather than an actively deployed modern service.
A secondary, weakly-sourced claim from a port-lookup site ties 545/tcp to OSIsoft PI Server client-access traffic, but that same source flags the mapping as assigned "by convention" rather than formal registration, and OSIsoft's own documentation more commonly cites port 5450 for PI Server client connectivity — so this attribution is treated here as unverified community noise, not a confirmed use.
- Exposure
- Internal-only — both identities behind 545/tcp (a discontinued Apple conferencing server and a Kerberized legacy remote-shell service) are administrative/legacy protocols with no legitimate reason to be reachable from the public internet.
- Remote-shell lineage
- The nmap-services description "Kerberos encrypted remote shell" ties 545/tcp to the
eklogin/ekshellpair, a Kerberos-authenticated descendant of the Berkeley r-commands (rsh/rlogin) family that has been broadly superseded by SSH. - No confirmed malware/CVE tie
- as of an August 2026 search, no CVE or malware family is recorded against 545/tcp specifically; auditmypc.com's port-545 page shows a "Virus/Trojan: No" verdict, cited here only for that negative finding.
- Fingerprinting value
- because the two source databases disagree on the service name, a live banner or protocol handshake on 545/tcp (QuickTime Conferencing vs. a Kerberized shell) is itself a useful signal for identifying which legacy stack a host is actually running.
- Unverified secondary claim
- OSIsoft PI Server client-access traffic reported on this port by one community port-lookup site is hedged by that same source as convention-based, not vendor-documented, and should not be treated as confirmed.
- IANA assignment
appleqtcsrvr— Description column reads the bare stringappleqtcsrvr("Apple QuickTime Conferencing Server" is an informal gloss, not the registry's wording); Reference blank; assignee Murali_Ranganathan; dual-registered 545/tcp + 545/udp[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry appleqtcsrvr 545/tcp- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry appleqtcsrvr 545/tcp
- Prevalence
- nmap-services open-frequency 545/tcp = 0.000276 (~0.028%, as
ekshell); 545/udp = 0.000478 (~0.048%, asappleqtcsrvr) [Confirmed] — this site's own tooling - Related ports
- 543/tcp (
klogin), 544/tcp (kshell) — the adjacent Kerberos r-command cluster; 5450/tcp (OSIsoft PI Server client access, per vendor convention)
Primary use
contested between the informal gloss "Apple QuickTime Conferencing Server" applied to IANA's appleqtcsrvr registration and the Kerberized ekshell remote-shell service (nmap-services name); no RFC governs either
Other/unofficial uses
OSIsoft PI Server client access reported by one community port-lookup site as a convention-based (not vendor-confirmed) mapping; vendor docs more commonly cite port 5450 for this
Security implications
legacy/administrative services on both identities; no CVE or malware association found tied to 545/tcp specifically as of an August 2026 search
Typically seen on
essentially unused today; historical/legacy Apple conferencing deployments or Kerberos r-shell (ekshell/eklogin) environments
- nmap-services naming (tcp-specific)
ekshell— "Kerberos encrypted remote shell -kfall" [Confirmed] — this site's own tooling (545 entry, tcp service ekshell)- Analyst note
- An open 545/tcp is rare; check whether the host answers as a QuickTime Conferencing server or a Kerberized remote shell before assuming either — the two source databases name this port differently, and the actual banner resolves which legacy service is present.
About port 545/udp.
Port 545/udp carries appleqtcsrvr, the server side of Apple's long-discontinued QuickTime Conferencing service, and it should not be exposed to the public internet — the underlying software has been out of use for years, so a responsive host today is far more likely to be an anomaly or fingerprint than a live legitimate service.
IANA registers both 545/tcp and 545/udp under the service name appleqtcsrvr, assignee Murali Ranganathan, with the description field simply repeating the service name and no RFC or reference document cited. No registration or modification date is recorded for the assignment.
appleqtcsrvr was the server component of Apple QuickTime Conferencing, a proprietary audio/video conferencing feature bundled with classic Mac OS and early Mac OS X. The software has not shipped for many years, and no vendor or community source documents any current legitimate use of it.
The nmap-services fingerprint corpus independently names 545/udp appleqtcsrvr too, matching IANA on this transport, but separately labels 545/tcp ekshell (Kerberos-encrypted remote shell). That is a naming split between two independently maintained sources on the TCP side, not a supersession, a dataset lag, or a live UDP dual-use.
Measured open-frequency from the repo's nmap-services-derived corpus is 0.000478 for 545/udp (~0.048%) and 0.000276 for 545/tcp (~0.028%, recorded there as ekshell). Both figures are low, consistent with a niche, largely-retired service rather than one commonly found open.
- Exposure
- Anomalous — 545/udp carries only the defunct
appleqtcsrvridentity in every source checked; unlike 545/tcp, which nmap-services also namesekshell(a legitimate, if legacy, Kerberos remote-shell service), there is no comparable legitimate identity on this transport, so a responsive host is unusual and worth investigating. - Malware associations
- No malware family or scanning-campaign writeup specific to 545/udp was found as of an August 2026 search. auditmypc.com's UDP-specific page (https://www.auditmypc.com/udp-port-545.asp) did not return port-specific content when checked — it rendered only the generic Port Lookup tool description — so it is not used as a source either way for this transport.
- Legacy naming caveat
- 545/tcp carries two different labels across datasets — IANA's
appleqtcsrvrand nmap-services'ekshell— while 545/udp is namedappleqtcsrvrconsistently in both, so treat any 545/tcp finding cautiously. - Analyst framing
- Given the service's age and rarity, prioritize investigating a responsive 545/udp as a fingerprint of an old Apple host, a decoy, or opportunistic probing rather than assuming targeted exploitation.
- IANA assignment
appleqtcsrvr— description "appleqtcsrvr" (repeats the service name); assignee Murali Ranganathan (registry handle [Murali_Ranganathan]; no email address in the cached registry); reference blank; dual-registered 545/tcp + 545/udp[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry appleqtcsrvr 545/udp- Range class
- well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry appleqtcsrvr 545/udp
- Prevalence
- nmap-services-derived open-frequency 545/udp = 0.000478 (~0.048%); 545/tcp = 0.000276 (~0.028%, recorded there as
ekshell) [Confirmed] — this site's own tooling port 545 - Related ports
- 544/tcp (
kshell); 554/tcp,udp (RTSP / QuickTime Streaming Server, a distinct Apple media protocol)
Primary use
server component of Apple QuickTime Conferencing, a legacy audio/video conferencing service [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?page=10, https://www.speedguide.net/port.php?port=545
Other/unofficial uses
none corroborated; nmap-services independently names 545/udp appleqtcsrvr (matching IANA) and separately labels 545/tcp ekshell (Kerberos-encrypted remote shell) — a naming split confined to the TCP transport, not a dual-use of 545/udp
Security implications
no CVE or malware family documented as of an August 2026 search; the underlying service is long discontinued so legitimate traffic is rare
Typically seen on
legacy classic Mac OS / early Mac OS X hosts that once ran QuickTime Conferencing; not expected on modern systems
- Community-sourced application sightings
- none found; no vendor doc, blog post, or forum/support thread reporting third-party software observed using 545/udp turned up in an August 2026 search [Unknown]
- Analyst note
- A responsive 545/udp is unusual given the age of appleqtcsrvr/QuickTime Conferencing — treat it as a low-confidence anomaly or fingerprinting signal rather than expected traffic; no source ties malware to this port as of August 2026.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| appleqtcsrvr | UDP | — | 0.05% |
| ekshell | TCP | Kerberos encrypted remote shell -kfall | 0.03% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.