562

Port 562/tcp carries chshell, an IANA-registered legacy remote-command service (registry description "chcmd"); it should stay internal-only rather than be reachable from the public internet.

The IANA service-names-port-numbers registry lists the service key chshell as registered for both TCP and UDP on port 562, with the description field reading "chcmd" for both transports. No assignee organization and no RFC or other formal reference is recorded against either row.

RFC 1340 (July 1992), line 1109, independently records "chshell 562/tcp chcmd", confirming the registry pairing. No protocol specification, current vendor implementation, or active deployment of chshell/chcmd beyond this bare registration has been identified.

The repo's port-frequency data (this site's own tooling, built from nmap-services) records a measured open-frequency of 0 for 562/tcp and 0.000346 for 562/udp, consistent with a legacy registration that sees essentially no real-world traffic today.

RFC 1340 line 1107 records "monitor 561/tcp" immediately above the chshell entry; some secondary sources reverse this pairing and label port 562 as "monitor," which is the assignment for the adjacent port 561, not 562.

Authentication

No documented authentication or encryption mechanism exists for chshell/chcmd; exposure should be restricted to internal networks at most.

Prevalence

this site's own tooling records an open-frequency of 0 for 562/tcp and 0.000346 for 562/udp, indicating negligible real-world usage on either transport.

Service name

chshell [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry chshell 562/tcp)

Malware/trojan association

none identified as of a September 2026 search [Unknown] (WebSearch queries and NVD search, September 2026 — no results)

Description

chcmd [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry chshell 562/tcp)

TCP registration

Yes [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry chshell 562/tcp)

UDP registration

Yes [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry chshell 562/udp)

Assignee

none recorded [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry chshell 562/tcp)

RFC/reference

none recorded in the IANA registry; RFC 1340 line 1109 independently records the name-to-port mapping [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry chshell 562/tcp; https://www.rfc-editor.org/rfc/rfc1340.html)

TCP open-frequency (measured)

0 [Confirmed] (this site's own tooling, built via this site's own tooling from nmap-services)

UDP open-frequency (measured)

0.000346 [Confirmed] (this site's own tooling, built via this site's own tooling from nmap-services)

Modern software/vendor usage

none identified as of a September 2026 search [Unknown] (WebSearch queries, September 2026 — no sightings surfaced)

Port 562/udp carries the IANA-registered chshell service, also listed under the alias chcmd; it is a legacy, essentially unused registry entry that should never be exposed to the public internet.

The name traces to RFC 1700 (October 1994, now obsolete and historic), which recorded the chshell/chcmd remote-shell service name alongside the port assignment. No protocol-defining RFC specifies chshell/chcmd's wire format or behavior — RFC 1700 only records the name-to-port mapping, so the IANA Reference field for this entry stays blank.

Real-world scan telemetry in nmap's service-probability database shows the port is almost never found open: 562/udp carries an open-frequency of 0.000346 (roughly 3 to 4 hosts per 10,000 scanned), and 562/tcp reads 0. Both are among the lowest non-zero and zero readings in the dataset, consistent with a dormant registry entry rather than an active service.

No vendor software, game or P2P client, or malware/trojan family was found associated with 562/udp as of a September 2026 search. No CVE is recorded against chshell, chcmd, or port 562 in the sources checked. The service name's remote-shell/remote-command lineage means any host observed with this port open merits investigation rather than assumption of a benign, modern application.

Exposure

Classified Anomalous — chshell/chcmd is a legacy remote-shell/remote-command service name with no known modern implementation; a host with 562/udp open should be investigated, not assumed benign.

Prevalence

nmap-services open-frequency is 0.000346 on udp and 0 on tcp — among the lowest readings in the dataset, indicating the port is almost never found open in the wild.

Software sightings

Unknown — no vendor documentation, blog post, or forum thread reports software generating traffic on 562/udp as of a September 2026 search.

IANA Service Name

chshell [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry)

IANA Reference

Unknown — no protocol-defining RFC; RFC 1700 records only the name-to-port assignment [Confirmed] (https://www.rfc-editor.org/rfc/rfc1700.html)

Prevalence

0.000346 open-frequency on udp, 0 on tcp [Confirmed] (this site's own tooling)

Common Software

Unknown — no sightings found as of a September 2026 search [Unknown]

Malware Association

Unknown — no CVE or trojan family found as of a September 2026 search [Unknown]

Description/Alias

chcmd [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry)

Registered Transports

Dual-registered for tcp and udp [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry)

Assignee

Unknown — no assignee recorded in the registry [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry)