691

Port 691/tcp is registered with IANA as msexch-routing with the description "MS Exchange Routing" and a likely-blank reference field (dual-registered on TCP and UDP); the IANA row was corroborated against Microsoft documentation and authoritative port references but was not re-verified against the live IANA CSV this session, so the exact strings should be confirmed before promotion. The Microsoft Exchange Routing Engine (RESvc) listens on TCP 691 for link-state routing information: Exchange 2000 and 2003 use the Link State Algorithm, based on the OSPF Dijkstra shortest-path approach, to propagate routing topology between routing groups, with Routing Group Members keeping a persistent TCP 691 connection to the Routing Group Master and cross-routing-group propagation using the X-LINK2STATE (X-LSA-2) verb over SMTP on port 25; Microsoft Learn documents a diagnostic in which a failure to connect to the routing master on port 691 indicates routing failures. Because a link-state algorithm requires a reliable connection, TCP is used rather than UDP despite the UDP registration. The IANA reference is likely blank. Security-wise the notable point is end-of-life context: link-state routing was deprecated in Exchange 2007 and later, which moved to Active Directory site-based routing and abandoned the link-state algorithm, so an open 691 today indicates a legacy Exchange 2000/2003 server — a strong end-of-life and patch-risk signal even though no well-known CVE is specifically tied to the port. For an analyst, an open 691 marks a long-out-of-support Exchange server and the host itself is the risk.

IANA assignment

msexch-routing — "MS Exchange Routing"; reference (likely blank; IANA row not re-confirmed against the live CSV this session — verify before DONE); dual-registered 691/tcp + 691/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low/legacy; nmap-services de-facto low [Well-established] — nmap-services file

Related ports

25 (SMTP, X-LINK2STATE), 135 (Exchange RPC endpoint mapper), 3268/3269 (Global Catalog)

Primary use

Microsoft Exchange link-state routing between routing groups (Exchange 2000/2003)

Other/unofficial uses

none meaningful [Well-established]

Security implications

deprecated in Exchange 2007+ (moved to AD site-based routing); an open 691 indicates a legacy, out-of-support Exchange 2000/2003 server [Well-established]

Typically seen on

legacy Exchange 2000/2003 servers

Analyst note

An open 691 marks a long-out-of-support Exchange 2000/2003 server; the host itself is the risk.