60
Summary
- // if you see it open
- No exploit, trojan, CVE, or named malware C2 is specifically documented for 60/tcp. Risk is incidental: an enabled auditd remote listener on port 60 without firewall controls could expose or allow probing of sensitive audit-log data. SANS ISC scanning data is consistent with broad low-port reconnaissance sweeps rather than targeted exploitation.
- // analyst note
- An open port 60 most plausibly indicates an enabled auditd remote-record collector; absent that, treat as opportunistic low-port reconnaissance. No official IANA service backs this port.
About port 60/tcp.
Port 60/tcp is listed as Unassigned in the IANA Service Name and Transport Protocol Port Number Registry: no service name, no assignee, no registration date, no RFC reference, and no notes are recorded, and 60/udp is identically Unassigned. Because nothing is registered, the IANA Reference column is genuinely blank and stays blank. The only documented real-world association is incidental rather than official: several Linux distributions — most notably SUSE Linux Enterprise Server — ship /etc/audit/auditd.conf with tcp_listen_port = 60 as the *commented-out example value* for the Linux Audit Daemon (auditd) remote-logging listener. When an administrator uncomments and enables it, auditd listens on TCP 60 for remote audit records forwarded by audisp-remote (audispd-plugins) clients, which is how centralized audit-log collection is wired up. This is opt-in: it is not active out of the box, and the auditd.conf man page does not define port 60 as a hardcoded default — it is an example only, so any "default" claim is tagged Likely rather than Confirmed. SANS ISC records recurring opportunistic scanning against port 60/tcp, with a community note (2024-10-22) describing port 60 as the auditd default on various distributions; no named malware family, trojan, or CVE is canonically linked to the port. Practical exposure risk is low in typical deployments because the listener is commented out by default, and rises only when an administrator enables it without firewall controls, since audit logs can carry sensitive system-event data. For an analyst, an open port 60 is best read as either an enabled auditd remote collector or generic low-port reconnaissance.
- IANA assignment
- Unassigned — no service name, no assignee, no registration date, no RFC reference, no notes; 60/udp identically Unassigned; Reference column blank (no RFC cited) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry
- Range class
- well-known (0–1023)
- Related ports
- well-known low-port range; centralized-logging peers (e.g., 514/syslog)
Primary use
none official; in practice the *example/commented-out* value for auditd's tcp_listen_port remote-logging listener in some Linux distro configs (notably SLES)
Common software
Linux Audit Daemon (auditd) — listens for remote audit records from audisp-remote (audispd-plugins) clients when tcp_listen_port = 60; opt-in, not enabled out of the box; not a man-page hardcoded default
Exposure / scanning
SANS ISC records recurring opportunistic scanning against 60/tcp; community note (2024-10-22) ties port 60 to auditd defaults on various Linux distros; single-IP recon bursts observed
Security implications
no exploit, trojan, CVE, or named malware C2 specifically documented; risk is incidental — an enabled auditd listener on 60 without firewall controls could expose/probe sensitive audit-log data; scanning looks like broad low-port sweeps, not targeted exploitation
Typically seen on
Linux hosts with centralized auditd remote logging explicitly enabled; otherwise generic scan noise
- Analyst note
- An open port 60 most plausibly indicates an enabled auditd remote-record collector; absent that, treat as opportunistic low-port reconnaissance. No official IANA service backs this port.
About port 60/udp.
Port 60/udp is listed as Unassigned in the IANA Service Name and Transport Protocol Port Number Registry: the service-name, assignee, contact, registration-date, modification-date, and reference columns are all blank. The TCP counterpart at 60/tcp is identically Unassigned, so the number is unassigned on both transports rather than reserved for one and free on the other. Port 60 sits inside the Well-Known Ports range (0–1023), where assignments require IETF Review or IESG Approval; it has simply never received one. There is no registered protocol, no canonical daemon, and no widely shipped software that binds this number by default. Because the port carries no IANA assignment, any UDP traffic actually observed on it is non-standard by definition and is worth inspecting rather than waving through as a known service. No malware family, trojan, or historically notable scanning campaign tied specifically to 60/udp turned up in available sources as of June 2026, though broad internet-wide scanners (Nmap, Shodan, masscan) will still probe it as part of full-range sweeps. The honest analyst takeaway: an unassigned well-known port whose appearance on the wire is the signal, since there is no legitimate service it could represent.
- IANA assignment
- Unassigned — service name, assignee, contact, registration/modification dates, and reference all blank [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=60); cached copy the IANA Service Name and Transport Protocol Port Number Registry line 129
- IANA reference
- blank — no RFC or document cited in the registry (left blank, not fabricated) [Confirmed] — IANA registry, cached CSV line 129
- Range class
- well-known (0–1023); assignment requires IETF Review or IESG Approval [Confirmed] — IANA registry policy notes
Primary use
none registered; no canonical protocol or daemon binds 60/udp by default
Common software
none known
Security implications
no malware/trojan or campaign documented specifically for 60/udp as of June 2026; being unassigned, observed traffic is non-standard and warrants inspection; general scanners (Nmap, Shodan, masscan) probe it in full-range sweeps [Likely] — single-source web review (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=60), absence-of-evidence
Exposure / scanning prevalence
Unknown — no Shodan dataset or internet-wide scan report specific to 60/udp located
Typically seen on
nothing legitimate; appearance on the wire is itself anomalous
- TCP counterpart
- 60/tcp is also Unassigned (dual-unassigned) [Confirmed] — cached CSV line 128
- Analyst note
- Treat any UDP traffic on port 60 as anomalous given its unassigned status; there is no service it could legitimately represent.