631

Port 631/tcp is registered with IANA as ipp with the description "IPP (Internet Printing Protocol)," assignee IESG (contact the IETF Chair), reference [RFC8011], and a modification date of 2018-07-06 (dual-registered on TCP and UDP); a TCP-only companion row ipps ("Internet Printing Protocol over HTTPS," also [RFC8011]) shares the port. IPP is an HTTP-based printing protocol — IPP requests ride on HTTP POST to the server on 631/tcp — for submitting and managing print jobs, and it is the native protocol of CUPS (the Common UNIX Printing System, the default print system on most Linux and macOS) and of modern driverless printing (IPP Everywhere, AirPrint-adjacent). CUPS also exposes its web administration interface on TCP 631 and uses UDP 631 for the legacy CUPS Browsing printer-discovery protocol; CUPS was created in 1999 and acquired by Apple in 2007. IPP/1.1 was originally RFC 2910/2911 (2000) and IPP/2.0 is RFC 8010/8011 (2017), which the registry now cites. The IANA reference field is [RFC8011]. The security headline is the September 2024 CUPS cluster disclosed by Simone Margaritelli (evilsocket) on 26 September 2024 (earlier than planned, after the details leaked on a forum): four chained CVEs enabling unauthenticated remote code execution on systems running cups-browsed — CVE-2024-47176 (cups-browsed binds UDP INADDR_ANY:631 and trusts any packet, triggering an IPP request to an attacker URL), CVE-2024-47076 (libcupsfilters fails to validate IPP attributes), CVE-2024-47175 (libppd fails to sanitize IPP attributes written to a temporary PPD), and CVE-2024-47177 (cups-filters foomatic-rip command injection via the FoomaticRIPCommandLine PPD parameter) — where an attacker registers a malicious printer and arbitrary commands run as root when a print job is sent to it (cups-browsed is disabled by default on RHEL but enabled by default on several other distros, and CVSS scores were rescored after disclosure). Akamai's SIRT separately showed the same CVE-2024-47176 flaw is a DDoS amplification vector, with a single ~30-byte UDP packet yielding roughly 18,000 bytes of reflected traffic (about 600x amplification), and found more than 198,000 internet-exposed CUPS devices of which roughly 58,000 could be abused. For an analyst, an open 631 is a CUPS server or network printer: check for cups-browsed exposure and the 2024 cluster, and never expose UDP 631.

IANA assignment

ipp — "IPP (Internet Printing Protocol)"; reference [RFC8011]; assignee IESG (IETF Chair contact); modification 2018-07-06; companion ipps row (TCP-only, [RFC8011]) shares the port; dual-registered 631/tcp + 631/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

high; CUPS on virtually every Linux/macOS host plus network printers; in nmap's default top-1000 [Well-established] — nmap-services file

Related ports

515 (LPD), 9100 (JetDirect/raw), 5353 (mDNS/AirPrint)

Primary use

HTTP-based print job submission/management (IPP); native protocol of CUPS

Other/unofficial uses

CUPS web admin (TCP 631); CUPS Browsing discovery (UDP 631); IPP Everywhere / AirPrint-adjacent driverless printing [Well-established]

Security implications

Sept 2024 cups-browsed cluster (CVE-2024-47176/47076/47175/47177, unauth RCE as root; evilsocket disclosure 26 Sep 2024); Akamai UDP-631 amplification DDoS (~600x; >198,000 exposed CUPS, ~58,000 abusable); older CUPS web-admin/IPP issues; never expose UDP 631

Typically seen on

Linux/macOS hosts (CUPS), network printers, print servers

Analyst note

An open 631 is a CUPS server or network printer; check for cups-browsed exposure and the 2024 cluster, and never expose UDP 631.

Port 631/udp is registered with IANA as ipp ("IPP - Internet Printing Protocol"), assignee IESG, contact IETF Chair, reference RFC 8011, and dual-registered on TCP and UDP. The IANA registration-date column is blank, but the entry carries a modification date of 2018-07-06. There is an important gap between the registration and the real-world traffic: IPP itself, the protocol that carries print jobs and printer attributes, runs over TCP/631 for reliable transport — modern clients (CUPS, Windows IPP, iOS/macOS AirPrint) all use the TCP side, and mDNS/DNS-SD discovery (Bonjour) uses UDP/5353, not UDP/631. The dominant real-world consumer of UDP/631 is instead the legacy CUPS Browse Protocol implemented in the cups-browsed daemon found on most Linux distributions and macOS. cups-browsed binds 0.0.0.0:631/UDP and listens for broadcast/unicast printer announcements; on receiving a valid one it connects back over TCP to the advertised IPP server to fetch printer attributes (PPD data). That listener became a major security topic in September 2024, when a four-CVE remote-code-execution chain was disclosed against cups-browsed ≤ 2.0.1 (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177; CVSS up to 9.0). The core flaw, CVE-2024-47176 (CVSS 8.3), is that cups-browsed binds to 0.0.0.0 rather than localhost, so an unauthenticated attacker can send a single UDP packet to port 631 carrying a fake printer URL; cups-browsed fetches it, attacker-controlled PPD data is written to disk, and arbitrary commands run on the next print job (CVE-2024-47177, CVSS 9.0). At disclosure Censys counted 63,096 exposed CUPS services, roughly 7,289 on affected cups-browsed versions, with the US, South Korea, and Taiwan most exposed; active scanning of UDP/631 was observed within hours. The legacy Browse Protocol has since been deprecated and removed in newer cups-browsed releases. For an analyst, a reachable UDP/631 is effectively cups-browsed and should be firewalled off any untrusted network.

IANA assignment

ipp — "IPP - Internet Printing Protocol"; reference RFC 8011; assignee IESG; contact IETF Chair; dual-registered 631/tcp + 631/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (CSV line 1290)

IANA registration date

blank (not recorded in the IANA registry); modification date 2018-07-06 [Confirmed] — IANA registry CSV / xhtml search=631

Range class

well-known (0–1023)

Related ports

631/tcp (ipp + ipps), 5353/udp (mDNS/DNS-SD/Bonjour discovery), the printing/discovery cluster

Primary use (de-facto on UDP)

CUPS Browse Protocol via the cups-browsed daemon — a legacy printer-discovery listener distinct from IPP proper; IPP print jobs themselves use TCP/631

Other/registered use

ipp (IPP) per RFC 8011; 631/tcp additionally carries ipps (IPP over HTTPS, same RFC 8011 reference)

Common software

cups-browsed (OpenPrinting/CUPS), present on most Linux distros and macOS; dominant consumer of UDP/631

Security implications

cups-browsed ≤ 2.0.1 binds 0.0.0.0:631/UDP (CVE-2024-47176, CVSS 8.3); unauthenticated single-UDP-packet trigger leads to RCE on next print job (CVE-2024-47177, CVSS 9.0), full chain CVE-2024-47076/47175/47176/47177 disclosed 2024-09-26

Exposure

~63,096 CUPS services exposed at disclosure, ~7,289 on affected cups-browsed versions; top countries US (2,230), South Korea (567), Taiwan (522); active UDP/631 scanning within hours of disclosure

Typically seen on

Linux/macOS hosts running cups-browsed; an internet-reachable UDP/631 is an exposure to investigate

Mitigation consensus

block UDP/631 at the firewall on untrusted interfaces; disable/remove cups-browsed if auto-discovery is not needed; patch CUPS/cups-filters (post Sept 2024); legacy Browse Protocol removed in newer releases [Confirmed] — UK security.gov.uk, Datadog, Censys

Analyst note

UDP/631 traffic is the legacy CUPS Browse Protocol, not IPP print transport — treat a public-facing UDP/631 as a CUPS exposure and check cups-browsed version against the Sept-2024 CVE chain.