604
Summary
- // if you see it open
- RFC 3620 advises limiting the hosts and services a proxy may contact and restricting use to authorized users. End-to-end TLS can protect tunneled data when certificates are properly configured; the RFC notes that a proxy could mount a man-in-the-middle attack without a deployed PKI.
About port 604/tcp.
TCP port 604 is assigned to TUNNEL, a BEEP profile for application-layer proxying between peers. The evidence describes an authorized tunneling mechanism, but does not establish that any particular host runs it or who should be able to reach it. Its intended public-internet exposure is therefore Unknown.
RFC 3620 describes tunnel requests that can route through one or more proxies, then pass data transparently between endpoints. The profile can support access to services through a firewall and may use authentication, but registration alone does not show deployment or configuration on a host.
The RFC advises restricting which hosts and services a proxy can contact and limiting use to authorized users. A service identified as TUNNEL should be assessed against its configured routing and authorization policy; the port number by itself cannot confirm the protocol or its safety.
- Exposure
- Unknown; the RFC describes proxying for authorized users, but the evidence does not establish an intended public-internet audience.
- Security
- RFC 3620 recommends limiting reachable hosts and services and restricting use to authorized users.
- Identification
- A TCP/604 assignment does not prove that a responding host implements TUNNEL.
- IANA service
- tunnel [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Protocol
BEEP TUNNEL profile for application-layer proxying
Exposure policy
Unknown; intended audience for public-internet access is not established
About port 604/udp.
IANA registers UDP port 604 as “tunnel” (TUNNEL) and cites RFC 3620, but the RFC specifies the TUNNEL profile’s well-known port for TCP. The supplied evidence does not establish a protocol or intended audience for 604/UDP, so whether it belongs on the public internet is Unknown.
RFC 3620 describes TUNNEL as a BEEP profile that lets cooperating peers form application-layer tunnels, including through a firewall. It discusses security risks such as unauthorized access and recommends limiting which hosts and services a proxy can contact. Those details describe the profile and do not establish its use over UDP.
Treat UDP traffic on port 604 as unidentified unless independent protocol evidence identifies it. The TCP allocation and profile behavior should not be assumed to apply to UDP.
- UDP service
- IANA registers 604/UDP as “tunnel” (TUNNEL); the RFC’s port allocation is for TCP. [Confirmed]
- Public access
- Intended audience and exposure policy for 604/UDP are Unknown; the supplied evidence does not establish UDP use. [Unknown]
- Security context
- RFC 3620 says TUNNEL can enable access through a firewall and recommends restricting reachable hosts and services. This is TCP-profile guidance, not evidence of UDP behavior. [Confirmed]
- Service name
- tunnel [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Exposure policy for 604/UDP
Unknown
- UDP protocol use
- Unknown; the cited RFC allocates 604 for TCP [Unknown] — https://www.rfc-editor.org/rfc/rfc3620.txt
- TUNNEL profile purpose
- BEEP application-layer tunneling between cooperating peers [Confirmed] — https://www.rfc-editor.org/rfc/rfc3620.txt
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| tunnel | TCP | — | 0.00% |
| tunnel | UDP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.