646

Port 646/tcp is registered with IANA as ldp with the description "LDP," assignee and contact Bob Thomas, and a blank reference field — the registry does not cite RFC 5036 or RFC 3036 — dual-registered on TCP and UDP. LDP, the Label Distribution Protocol (RFC 5036, October 2007, the successor to RFC 3036 of 2001), is the MPLS control-plane protocol by which Label Switch Routers (LSRs) exchange label-to-FEC mappings to build label-switched paths across an MPLS network. Its transport is deliberately split across both protocols on port 646: UDP 646 carries HELLO/neighbor discovery (Link Hellos are multicast to 224.0.0.2, "all routers on this subnet," while targeted or tLDP Hellos are unicast), and TCP 646 carries the LDP session itself (Initialization, label distribution, Keepalive, and Notification messages). LDP relies on an underlying IGP such as OSPF or IS-IS for routing and does not make routing decisions of its own; RFC 5036 was authored by the IETF MPLS working group (Loa Andersson, Paul Doolan, Nancy Feldman, Andre Fredette, and Bob Thomas — the same Bob Thomas listed as the IANA assignee). The IANA reference field is blank. Security-wise LDP is core MPLS infrastructure that should never be internet-exposed: without authentication, LDP sessions are vulnerable to spoofing and hijacking, so RFC 5036 recommends TCP MD5 authentication and operators increasingly use TCP-AO. For an analyst, an open 646 indicates an MPLS LSR (a provider or enterprise core router), and the UDP-646-hello versus TCP-646-session split is the key operational detail.

IANA assignment

ldp — "LDP"; reference (blank — RFC 5036/3036 are the defining specs but are NOT cited in the registry row); assignee Bob Thomas; dual-registered 646/tcp + 646/udp (UDP = hello discovery, TCP = session) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low (core routers); nmap-services de-facto low [Well-established] — nmap-services file

Related ports

179 (BGP), MPLS data plane

Primary use

MPLS label distribution between Label Switch Routers (RFC 5036)

Other/unofficial uses

none meaningful [Well-established]

Security implications

core MPLS infra; LDP session spoofing/hijacking without auth; RFC 5036 recommends TCP MD5 (operators add TCP-AO); never internet-expose

Typically seen on

MPLS provider/enterprise core routers (LSRs)

Analyst note

An open 646 indicates an MPLS LSR (provider/enterprise core router); remember the UDP 646 hello vs TCP 646 session split.