639

Port 639/tcp is registered with IANA as msdp with the description "MSDP," assignee and contact Dino Farinacci, and a blank reference field — the registry does not cite RFC 3618 — dual-registered on TCP and UDP. MSDP, the Multicast Source Discovery Protocol (RFC 3618, Experimental, October 2003), connects multiple PIM-SM multicast domains by letting their Rendezvous Points (RPs) exchange Source-Active (SA) messages, so receivers in one domain can learn of active multicast sources in another. It runs over TCP 639 between RP peers, and in a peering relationship the higher-IP peer listens on 639 while the other connects, which avoids a connection-establishment collision; MSDP is also used between Anycast-RPs for RP redundancy and is frequently co-located operationally with MP-BGP. RFC 3618 development stopped in 2006 — the authors chose not to advance it to the Standards Track — though it became the IPv4 de-facto inter-domain multicast standard. The IANA reference field is blank. Security-wise MSDP is niche; the documented risks include SA-message spoofing and flooding, and RFC 3618's security considerations recommend SA filtering, rate-limiting SA-state entries, and (for follow-on work) a stronger integrity mechanism such as HMAC-SHA1, while operators commonly apply TCP MD5 to MSDP sessions. For an analyst, an open 639 indicates a multicast RP router in a carrier or enterprise core and should never be internet-facing.

IANA assignment

msdp — "MSDP"; reference (blank — RFC 3618 is the defining spec but is NOT cited in the registry row); assignee Dino Farinacci; dual-registered 639/tcp + 639/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

very low; nmap-services de-facto low [Well-established] — nmap-services file

Related ports

179 (BGP — MP-BGP co-location), PIM

Primary use

inter-domain multicast source discovery between PIM-SM Rendezvous Points (RFC 3618)

Other/unofficial uses

Anycast-RP redundancy [Well-established]

Security implications

SA-message spoofing/flooding; RFC 3618 recommends SA filtering, rate-limiting, integrity (HMAC-SHA1); TCP MD5 commonly applied; never internet-expose

Typically seen on

multicast RP routers (ISP/enterprise core)

Analyst note

An open 639 indicates a multicast RP router in a carrier/enterprise core; should never be internet-facing.