6636
Summary
- // typical exposure
- Restricted (trusted networks only) — RFC 7510 says MPLS-in-UDP must be deployed within a single network or adjacent cooperating operator networks, rather than over the Internet, and recommends packet filters to prevent escape.
- // if you see it open
- RFC 7510 states MPLS-in-UDP alone does not ensure integrity, privacy, or tunnel-encapsulator authentication; it recommends IPsec or DTLS when these security concerns apply. It restricts deployment to a single network or cooperating operators and advises filtering to prevent packets escaping to the Internet.
About port 6636/udp.
IANA registers UDP port 6636 as mpls-udp-dtls, described as encapsulating MPLS packets in UDP tunnels with DTLS. The supplied RFC 7510 evidence describes MPLS-in-UDP and explicitly limits its deployment to a single network or cooperating operators, rather than the Internet. It does not establish that any particular host uses or exposes this port.
RFC 7510 explains that MPLS-in-UDP can help routers distribute traffic across equal-cost paths using UDP header fields. It also says the encapsulation alone does not provide packet integrity, privacy, or tunnel-encapsulator authentication, and recommends IPsec or DTLS where those protections are needed. The RFC's specified MPLS-in-UDP destination port is 6635; the supplied text does not explain how 6636's DTLS service relates to that encapsulation procedure.
Treat a sighting of 6636/udp as a registry-based clue, not proof of deployment or secure configuration. The available evidence gives no scoped usage measurement, observed applications, or malware association. Restrict access to the intended managed network context; the RFC calls for filtering to prevent MPLS-in-UDP packets from escaping to the general Internet.
- Exposure
- Restricted. RFC 7510 limits MPLS-in-UDP deployment to a single network or cooperating operators and advises filtering against Internet escape.
- Protocol
- IANA names UDP 6636
mpls-udp-dtlsand describes MPLS encapsulation in UDP tunnels with DTLS. - Security
- RFC 7510 says MPLS-in-UDP alone does not ensure integrity, privacy, or tunnel-endpoint authentication; IPsec or DTLS is recommended when those concerns apply.
- Deployment evidence
- Registry assignment is not evidence that a host currently uses or exposes this port.
- IANA service
mpls-udp-dtls[Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
- Registry description
- Encapsulate MPLS packets in UDP tunnels with DTLS [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
- RFC reference
- RFC 7510 [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
- Deployment scope
- Single network or adjacent cooperating operator networks; not the Internet [Confirmed] — https://www.rfc-editor.org/rfc/rfc7510.txt
- Observed host use
- Unknown [Unknown] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| mpls-udp-dtls | TCP | Encapsulate MPLS packets in UDP tunnels with DTLS. | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.