553

Port 553/tcp carries pirp, IANA's registered name for D. J. Bernstein's Public Information Retrieval Protocol; the protocol never reached RFC status or meaningful real-world deployment, so an open 553/tcp is an anomaly worth investigating rather than an expected public-facing service.

IANA registers 553 on both TCP and UDP as pirp, assignee [D_J_Bernstein], with a blank Reference field and no registration date recorded in the registry.

Bernstein published the protocol as Internet-Draft draft-bernstein-pirp-01 in February 1997, proposing a simple request-response scheme for publishing structured information as a lightweight alternative to HTTP. The draft expired without ever becoming an RFC, and no software is commonly observed running it today.

The nmap-services frequency data (built from nmap-services) records 553/tcp at an open-frequency of approximately 0.000038 (~0.004%) and 553/udp at approximately 0.000593 (~0.06%) — both negligible, consistent with a protocol that appears to have seen essentially no adoption.

A search conducted in August 2026 (IANA registry, AuditMyPC, SpeedGuide, adminsub.net, Wikipedia's List of TCP and UDP port numbers, and general scan-report/forum searches) turned up no credible sightings of specific named software generating traffic on this port; that field is reported as a sourced Unknown rather than guessed.

Malware note

No trojan/malware port list (Petri, chebucto) records an association for port 553 as of August 2026.

Best practice

Treat unsolicited traffic on 553/tcp with the same generic caution given to any little-used, effectively unadopted port.

IANA assignment

pirp — reference (blank — no RFC cited); assignee [D_J_Bernstein]; dual-registered 553/tcp + 553/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry pirp 553/tcp; the IANA Service Name and Transport Protocol Port Number Registry pirp 553/udp

Range class

well-known (0–1023) [Confirmed]

Prevalence

the nmap-services frequency data (nmap-services derived) open-frequency 553/tcp ≈ 0.000038 (~0.004%); 553/udp ≈ 0.000593 (~0.06%) [Confirmed] — this site's own tooling

Related ports

none directly paired; contrast with HTTP (80/tcp), the widely-adopted protocol PIRP was proposed as an alternative to [Likely]

Primary use

PIRP (Public Information Retrieval Protocol), Internet-Draft draft-bernstein-pirp-01 (D. J. Bernstein, February 1997) — a simple request-response scheme for publishing structured information, positioned as a lightweight alternative to HTTP; no RFC was ever issued and no known real-world deployment was found

Other/unofficial uses

none found — an August 2026 search across IANA, AuditMyPC, SpeedGuide, adminsub.net, and Wikipedia's List of TCP and UDP port numbers surfaced no named software or service

Security implications

no CVE recorded in the NVD as of an August 2026 search; no trojan/malware port list records an association; AuditMyPC's port-553 page is a bare IANA-registry mirror carrying no security assessment [Likely] — https://www.auditmypc.com/tcp-port-553.asp, https://petri.com/trojan_ports_list/, http://www.chebucto.ns.ca/~rakerman/trojan-port-table.html

Typically seen on

no confirmed deployments found; a niche, apparently unused registered service [Unknown]

Analyst note

an open 553/tcp has no established legitimate explanation given the protocol's apparent lack of real-world adoption — investigate rather than assume routine traffic.

Port 553/udp carries pirp, a proposed-but-never-adopted protocol, so a live listener here should be treated as unusual rather than expected on the public internet. IANA registers 553/udp (and 553/tcp) to the service name pirp, assignee D. J. Bernstein, with a blank Reference field.

PIRP stands for the Public Information Retrieval Protocol, an Internet-Draft Bernstein authored starting February 1997 as a simpler alternative to HTTP for publishing information. The draft expired without adoption, and no deployed PIRP implementation is documented as active today — the assignment is registered but effectively dormant.

Because no mainstream software is known to use 553/udp deliberately, the small nonzero open-frequency reading in the nmap-services corpus most plausibly reflects scanning noise, coincidental ephemeral-port traffic, or rare misconfigured listeners rather than genuine PIRP servers. One hedged community report (a dnscrypt-proxy GitHub issue) noted a firewall flagging outbound UDP traffic on "port 553 (pirp)," without explaining why — this is not confirmed protocol usage.

For an analyst, an open 553/udp is best treated the way a small-services or long-dead-protocol port is treated: worth noting as an anomaly and investigating for misconfiguration, decoy use, or an unrelated service that happens to bind the port, rather than assumed to be a normal information-retrieval endpoint.

Exposure

Essentially never legitimately open — PIRP has no known deployed implementation, so a responsive 553/udp is unusual and worth investigating.

Community sighting

A dnscrypt-proxy GitHub issue reports a firewall (Little Snitch) flagging outbound UDP traffic on "port 553 (pirp)," with no explanation given — a single hedged, unconfirmed report, not evidence of deliberate protocol use.

IANA assignment

pirp — description "pirp" (identical to service name, no elaboration in registry); reference blank; assignee D. J. Bernstein; dual-registered 553/tcp + 553/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry 1127

Range class

system/well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry 1127

Prevalence

nmap-services open-frequency 553/udp = 0.000593 (~0.059%); 553/tcp = 0.000038 (~0.004%) [Confirmed] — this site's own tooling

Related ports

553/tcp (same pirp dual registration) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry 1126

Primary use

Public Information Retrieval Protocol (PIRP), a February 1997 Internet-Draft by D. J. Bernstein proposed as a simpler alternative to HTTP; draft expired without adoption and no active implementation is documented

Other/unofficial uses

none documented; a single hedged community report ties incidental UDP traffic on this port to dnscrypt-proxy without explanation

Security implications

no CVE or malware association documented as of an August 2026 search; AuditMyPC records no IDS/malware indicator for this port

Typically seen on

no legitimate deployment documented; treat any responsive host as anomalous [Unknown]

Analyst note

PIRP never shipped in real products, so an open 553/udp is statistically rare and should be investigated as a misconfiguration, decoy, or unrelated service rather than assumed to be legitimate information-retrieval traffic.