601

TCP port 601 is assigned by IANA to syslog-conn, described as “Reliable Syslog Service,” with RFC 3195 cited. That assignment identifies the registered service, but the supplied evidence does not show whether a particular host runs it or whether it should be reachable from the public internet.

RFC 3195 describes reliable syslog delivery over TCP using BEEP and two profiles, RAW and COOKED. RAW keeps message payloads compatible with UDP-based syslog while BEEP provides ordered, reliable delivery. COOKED carries structured entries and supports positive or negative acknowledgements. These protocol details describe the standard, not observed deployments.

The RFC describes authentication and encryption as capabilities available through BEEP, with security dependent on provisioning. For an observed listener, verify its identity, configuration, and access policy before deciding whether its exposure is appropriate. The evidence provides no scoped traffic measurement or malware association.

Exposure

Unknown — registration and protocol specification do not establish whether TCP 601 is publicly reachable or appropriate for public access.

Protocol

Reliable syslog over TCP is specified by RFC 3195 using BEEP profiles RAW and COOKED.

Service name

syslog-conn, “Reliable Syslog Service” [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Protocol behavior

RFC 3195 specifies two syslog mappings over TCP using BEEP: RAW and COOKED

RFC reference

RFC 3195, Reliable Delivery for syslog [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Public exposure

Unknown; no host reachability or deployment observation is supplied [Unknown] — https://www.rfc-editor.org/rfc/rfc3195.txt