565

Port 565/tcp carries the legacy whoami identification service; it shows no evidence of active modern deployment and, as a service designed to return a user's login name, should stay internal-only rather than exposed to the public internet.

IANA registers 565 for whoami on both TCP and UDP, with the Description field duplicating the service name and a blank Reference field — no RFC is cited for this assignment. The Assignee column is also blank in the source registry.

By service name and description alone, whoami groups naturally with the early Internet identification services finger (79/tcp) and ident/auth (113/tcp): a client connects and the server is meant to return the login name of a user, rather than performing file transfer, control, or application work. This grouping is an inference from the registered name, not a sourced claim about how any real implementation of port 565 behaves.

No vendor documentation, software changelog, or online discussion was found describing an application that actually uses TCP or UDP port 565 for a whoami-style service, as of a September 2026 search. Public port-lookup aggregator pages restate the bare registry line without adding a verifiable source and were not used as citations.

Nmap-services open-frequency data records 565/tcp at a measured frequency of 0 (sampled, not observed open in the corpus); the paired 565/udp row carries a low but nonzero 0.000445, consistent with an obscure, seldom-open legacy service rather than an actively scanned or exploited one.

Exposure

Classified internal-only; a service designed to return a user's login name has no legitimate reason to answer requests from the public internet.

Info disclosure

Like finger (79) and ident (113), a reachable whoami responder can leak account/login-name information to an unauthenticated remote party if exposed externally.

Malware association

None documented as of a September 2026 search; a similarly-numbered antivirus label, Backdoor.TDSS.565 (Dr.Web's internal name for a TDL3 rootkit variant), is a vendor version/family designation unrelated to TCP or UDP port 565 and should not be read as a port association.

CVE / scanning activity

No CVE is recorded in the NVD as of a September 2026 search, and no port-scanning literature reviewed flags 565 as a notably scanned or abused port.

IANA service name

whoami [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry whoami 565/tcp)

IANA reference

blank — no RFC cited [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry whoami 565/tcp — blank)

Range class

well-known (0–1023) [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry whoami 565/tcp)

Protocol family

legacy Unix/Internet user-identification service; grouped with finger (79) and ident/auth (113) by registered service name and description only — an inference, not a sourced claim about port 565's actual behavior [Likely] (the IANA Service Name and Transport Protocol Port Number Registry whoami 565/tcp)

Malware association

none documented as of a September 2026 search; Backdoor.TDSS.565 is an unrelated antivirus family label, not a port association [Likely] (https://www.virusbulletin.com/virusbulletin/2010/03/backdoor-tdss-565-and-its-modifications-aka-tdl3)

Port

565 [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry whoami 565/tcp)

Transport

TCP, dual-registered with UDP [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry whoami 565/tcp and whoami 565/udp)

Assignee

blank in registry [Confirmed] (the IANA Service Name and Transport Protocol Port Number Registry whoami 565/tcp — blank)

Modern deployment

no vendor documentation, changelog, or online discussion describing an application using port 565 for a whoami-style service was found as of a September 2026 search [Unknown]

Applications observed

none credibly documented as of a September 2026 search [Unknown]

Port 565/udp carries whoami, a legacy IANA-registered identity/user-information service with no documented modern implementation; it has no legitimate reason to be open on a general-purpose host, and unsolicited traffic on it is more plausibly scanning noise or ephemeral-port coincidence than genuine whoami-protocol activity.

IANA registers 565 on both TCP and UDP as whoami, with the description field simply repeating the service name, no RFC or reference listed, and no assignee or registration date recorded in the registry. The dual TCP/UDP registration is confirmed directly from the registry row.

The whoami name places it in the small family of legacy Internet identity/user-information services from the early host-to-host protocol era, alongside services such as ident/auth on port 113. No current, actively maintained software was found implementing this service or generating traffic on 565/udp as of a September 2026 search.

On the security side, 565 does not appear on Gary Kessler's widely-cited Bad TCP/UDP Ports reference list as of a September 2026 check, which is a genuine negative signal since that list is compiled specifically to track malware/trojan port associations. No CVE names 565/udp as of a September 2026 NVD search.

Exposure

Anomalous — the whoami service has no documented modern deployment, so a listening or actively-traffic-generating 565/udp is not expected legitimate behavior.

Best practice

Treat any sighting of traffic on 565/udp as unidentified until corroborated — investigate as likely scanning/probing or ephemeral-port coincidence rather than assuming legitimate whoami-service use.

IANA assignment

whoami — description field repeats the service name; reference (blank — no RFC cited); assignee Unknown; dual-registered 565/tcp + 565/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry whoami 565/udp

Range class

well-known (0-1023) [Confirmed]

Prevalence

nmap-services open-frequency 565/udp ≈ 0.000445; 565/tcp ≈ 0.000000 (not observed open in scan corpus) [Confirmed] — this site's own tooling

Related ports

565/tcp (whoami, dual registration, same IANA row) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry whoami 565/tcp

Primary use

legacy Internet identity/user-information service family from the early host-to-host protocol era, alongside services such as ident/auth on port 113; no RFC reference and no documented modern implementation

Other/unofficial uses

none confirmed; no application or vendor documented as generating traffic on 565/udp despite searching vendor docs and forum threads [Unknown]

Security implications

not listed on Gary Kessler's Bad TCP/UDP Ports list as of a September 2026 check (negative signal); no CVE recorded in the NVD as of a September 2026 search

Typically seen on

no application or vendor documented; unsolicited traffic is more likely scanning/probing or ephemeral-port coincidence than legitimate whoami-service use [Unknown]

Analyst note

an open or active 565/udp with no known legitimate deployment should be treated as unidentified traffic and investigated rather than assumed to be routine whoami-service activity.