694

Port 694/tcp is registered with IANA as ha-cluster with the description "ha-cluster" and a likely-blank reference field (dual-registered on TCP and UDP); the IANA row was corroborated against Linux-HA documentation and authoritative port references but was not re-verified against the live IANA CSV this session, so the exact strings should be confirmed before promotion. It denotes the Linux-HA "Heartbeat" cluster messaging layer — node liveness and heartbeat exchange between high-availability cluster nodes — and operationally it is famously a UDP service: the ha.cf udpport directive defaults to "ha-cluster in /etc/services, or 694," and Linux-HA documentation states plainly that 694 is the IANA-registered port number for Heartbeat (a.k.a. ha-cluster) and the official registered port, with Heartbeat using UDP 694 for unicast (ucast), broadcast (bcast), and multicast (mcast) heartbeats; running Heartbeat through a firewall requires permitting UDP 694 in and out. In lineage terms, Heartbeat dates to the late-1990s and 2000s Linux-HA project and its functionality was largely superseded by Pacemaker plus Corosync (the modern ClusterLabs stack), with classic ha.cf features such as watchdog and ipfail deprecated in favor of STONITH and pingd resource agents. The IANA reference is likely blank. Security-wise Heartbeat supports authkeys (crc, md5, or sha1 authentication of cluster messages), and clusters should always enable a strong sha1 auth key, since an attacker who can inject on the heartbeat network could trigger split-brain or resource takeover. For an analyst, an open or active 694 — especially on UDP — indicates a Linux HA cluster node, implying a peer node and shared resources such as virtual IPs and services.

IANA assignment

ha-cluster — "ha-cluster"; reference (likely blank; IANA row not re-confirmed against the live CSV this session — verify before DONE); dual-registered 694/tcp + 694/udp (UDP is the operational transport) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low; nmap-services de-facto low [Well-established] — nmap-services file

Related ports

5404/5405 (Corosync — modern successor messaging)

Primary use

Linux-HA Heartbeat cluster messaging / node liveness

Other/unofficial uses

none meaningful [Well-established]

Security implications

enable authkeys (sha1) — injection on the heartbeat network could cause split-brain/resource takeover; superseded by Pacemaker/Corosync [Well-established]

Typically seen on

Linux-HA cluster nodes

Analyst note

An open/active 694 (especially UDP) indicates a Linux HA cluster node; expect a peer node and shared resources (virtual IPs, services).