550
Summary
- // typical exposure
- Internal-only — new-rwho carries unauthenticated, unencrypted user-login broadcast data meant only for a trusted local network, so exposing it to the public internet would leak internal user activity to any prober.
- // common applications
- rwhod Traffic on this port is most often associated with the legacy BSD rwho user-status broadcast mechanism; the rwhod daemon has been reported as the successor service's implementation, though modern sightings are rare and this is community-sourced rather than independently confirmed.
- // analyst note
- A responsive 550/tcp is statistically rare (measured frequency 0) and the underlying rwho protocol was designed for UDP broadcast, not TCP — treat an open 550/tcp as worth investigating rather than as expected legacy service traffic.
- // if you see it open
- rwho-family traffic is unauthenticated and unencrypted, exposing internal user-login activity and susceptible to spoofing on a shared network segment. No CVE is recorded in the NVD tied to port 550 or new-rwho as of an August 2026 search, and no malware association was found.
About port 550/tcp.
Port 550/tcp carries new-rwho, IANA's registered successor to the classic BSD rwho user-status broadcast service; it should stay internal-only and never be exposed to the public internet.
The original rwho/rwhod mechanism let Unix hosts on a local network periodically broadcast which users were logged in, so other hosts could build an rwho/ruptime-style listing. That legacy service ran on udp/513. new-rwho (IANA description "new-who") is registered as its successor, on both 550/tcp and 550/udp, with no RFC cited in the reference column.
Community write-ups describe the same rwhod daemon lineage as the software behind this registration, but no widely-documented modern application uses port 550/tcp for anything else, and no dedicated protocol RFC could be confirmed.
Measured nmap-services open-frequency for this exact row is 0 for 550/tcp — a sampled, not-observed-open reading — versus 0.00117 for 550/udp, consistent with rwho's original design as a UDP broadcast mechanism rather than a TCP service. As of an August 2026 search, no CVE is recorded in the NVD tied to port 550 or new-rwho, and no scanning-prevalence figures (e.g., Shodan counts) surfaced for this port.
- Exposure
- rwho-family traffic is unencrypted and unauthenticated, exposing internal user-login activity to anyone who can reach it — keep it confined to a trusted local broadcast domain, never the public internet.
- Spoofing risk
- because there is no authentication, a listener or sender on the same segment can forge or harvest user-presence data.
- Prevalence
- nmap-services open-frequency reads exactly 0 for 550/tcp (sampled, not observed open) and 0.00117 for 550/udp, the transport rwho was originally designed for.
- CVE/malware
- no CVE is recorded in the NVD tied to port 550 or new-rwho as of an August 2026 search, and no credible source associates the port with malware.
- IANA assignment
new-rwho— "new-who"; reference[n/a](no RFC cited); assignee not listed; dual-registered 550/tcp + 550/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry new-rwho 550/tcp- Range class
- system/well-known (0-1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 550/tcp = 0 (sampled, not observed open); 550/udp ≈ 0.00117 [Confirmed] — this site's own tooling
- Related ports
- 513/udp (historical
rwho); 513/tcp (rlogin, unrelated protocol sharing the 513 well-known number) [Likely]
Primary use
successor to the BSD rwho user-status broadcast service; rwhod periodically broadcasts logged-in-user information on a local network
Other/unofficial uses
none widely documented beyond the rwhod/rwho/ruptime lineage itself [Unknown]
Security implications
unauthenticated, unencrypted user-presence broadcast; no NVD CVE found as of an August 2026 search; no malware association found
Typically seen on
legacy Unix/BSD hosts running rwhod on a local network; essentially never seen open on 550/tcp per measured prevalence [Likely]
- Analyst note
- A responsive 550/tcp is statistically rare (measured frequency 0) and the underlying rwho protocol was designed for UDP broadcast, not TCP — treat an open 550/tcp as worth investigating rather than as expected legacy service traffic.
About port 550/udp.
Port 550/udp carries new-rwho (also called new-who), a legacy Unix/BSD broadcast service; it should stay internal-only and never be exposed to the public internet. It is the successor to the original rwho protocol (513/udp), periodically broadcasting or multicasting short datagrams listing logged-in users and host status so administrators could see who was active across a LAN.
The service is unauthenticated and unencrypted by design, trading security for low overhead — a normal tradeoff for a 1980s–90s LAN convenience tool, but one that makes any internet-facing instance a straightforward information-disclosure risk today.
IANA registers new-rwho identically on both 550/tcp and 550/udp, with a blank Assignee field and a literal [n/a] in the Reference column — no RFC is cited for this assignment. No specific vendor application beyond the historical rwhod daemon itself was found generating traffic on this port.
As of an August 2026 search, the service appears largely obsolete: rwho-family tools were superseded by SSH-based session queries and centralized monitoring, and no evidence of active mainstream deployment surfaced.
- Exposure
- Unauthenticated, unencrypted broadcast/multicast service designed for trusted LAN segments; should never be reachable from the public internet [Likely] — https://man.freebsd.org/cgi/man.cgi?query=rwho&sektion=1
- Data disclosure
- A responsive new-rwho service leaks logged-in-user and host-status information to anyone who can reach it, with no authentication [Likely] — https://whatportis.com/ports/550_new-rwho-new-who
- Notable CVE
- None found as of an August 2026 search of the NVD tied specifically to 550/udp or new-rwho
- Malware association
- None documented as of an August 2026 search; auditmypc.com's port page returned no usable content in this pass and is not cited either way
- Current relevance
- Largely obsolete legacy protocol; a live instance today is more likely a forgotten legacy host than a maintained service [Likely] — https://man.freebsd.org/cgi/man.cgi?query=rwho&sektion=1
- IANA assignment
new-rwho— "new-who"; reference[n/a](no RFC cited); assignee blank; dual-registered 550/tcp + 550/udp with identical details [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry new-rwho 550/udp- Range class
- system/well-known (0–1023) [Confirmed] — this site's own tooling (range: "system")
- Prevalence
- nmap-services open-frequency 550/udp = 0.00117 (~0.12%); 550/tcp = 0 (sampled, not observed open) [Confirmed] — this site's own tooling
- Related ports
- 513/udp (
rwho, predecessor protocol); 550/tcp (identical dual registration)
Primary use
successor to rwho (513/udp); broadcasts logged-in-user and host-status info across a LAN for administrative visibility
Other/unofficial uses
none documented beyond the reference rwhod daemon itself
Security implications
unauthenticated/unencrypted LAN-local broadcast service; discloses user/host info if reachable; no CVE or malware association found
Typically seen on
legacy Unix/BSD hosts historically running rwhod-family daemons; otherwise unexpected [Likely]
- Analyst note
- A responsive 550/udp is most plausibly a legacy or forgotten LAN service rather than an intentional modern deployment; treat exposure to untrusted networks as a disclosure risk regardless of rarity.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| new-rwho | UDP | new-who | 0.12% |
| new-rwho | TCP | new-who | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.