7
Summary
- // if you see it open
- UDP echo (7/udp) participates in the echo-chargen 'ping-pong' / UDP packet-storm loop (CERT CA-1996-01, Feb 1996): forged packets connect UDP echo to UDP chargen (19), flooding the link. CVE-1999-0103 covers the echo/chargen packet storm; echo is also abused in fraggle-style floods. TCP echo is NOT a reflection/amplification vector because TCP requires a handshake. Disable as part of small-services hardening.
- // analyst note
- An open echo today usually means an unhardened legacy host or a device with small-servers on; close it — it aids floods and reconnaissance.
About port 7/tcp.
Port 7/tcp is registered with IANA as echo with the description "Echo," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP, with 7/sctp also listed). The protocol is one of the original "small services," defined in RFC 862 (Postel, ISI, May 1983): an echo server simply sends back whatever data it receives. On TCP the server echoes the byte stream until the client closes the connection; on UDP it returns the data of each received datagram in an answering datagram. It was designed as a debugging and measurement tool — a way to confirm reachability and round-trip behavior at the application layer. The IANA reference field is blank. The security story is entirely UDP-side: 7/udp is a participant in the classic echo-chargen "ping-pong" or "UDP packet storm" loop documented in CERT Advisory CA-1996-01 (February 1996), in which an attacker forges packets to connect UDP echo on one host to UDP chargen (port 19) on another, generating a self-sustaining flood that consumes all bandwidth between them; CVE-1999-0103 covers the echo/chargen UDP packet-storm denial of service, and echo is also abused in fraggle-style UDP floods. Crucially, the TCP echo service is not a reflection/amplification vector, because TCP requires a three-way handshake and so cannot be trivially spoofed. These small services were historically enabled by default in inetd and on Cisco IOS, and modern hardening guidance (and modern defaults) is to disable them. For an analyst, an open echo today usually signals a legacy or unhardened host (or a network device with small-servers left on); it aids floods and reconnaissance and should be closed.
- IANA assignment
echo— "Echo"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 7/tcp + 7/udp (7/sctp also listed) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 7/tcp ≈ 0.004855; 7/udp ≈ 0.024679 (de-facto) [Well-established] — nmap-services file
- Related ports
- 19 (chargen — the ping-pong partner), 9 (discard), 13 (daytime), 17 (qotd); 7/udp sibling
Primary use
echo back received data for testing/measurement (RFC 862)
Other/unofficial uses
network testing tools; Wake-on-LAN magic packets sometimes sent to UDP 7 [Well-established]
Security implications
UDP echo participates in the echo-chargen ping-pong / UDP packet-storm loop (CERT CA-1996-01, 1996; CVE-1999-0103); abused in fraggle-style floods; TCP echo is NOT a reflection vector (handshake required); disable as part of small-services hardening
Typically seen on
legacy Unix hosts, Cisco IOS small-servers, printers/embedded devices
- Analyst note
- An open echo today usually means an unhardened legacy host or a device with small-servers on; close it — it aids floods and reconnaissance.
About port 7/udp.
Port 7/udp is registered with IANA as echo with the description "Echo," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP, with 7/sctp also listed; the udp row is identical to the tcp row). It is one of the original "small services," defined in RFC 862 (Postel, ISI, May 1983): a UDP echo server returns the data of each datagram it receives in an answering datagram, byte-for-byte, to the originating source. It was designed as a debugging and measurement tool — a way to confirm reachability and round-trip behavior at the application layer (tools such as echoping used it for RTT measurement). The IANA reference field is blank; no RFC is cited in the registry row. Unlike the TCP variant, the UDP service is where the security weight sits, because UDP is connectionless and trivially spoofable. 7/udp is the classic participant in the echo-chargen "ping-pong" or "UDP packet storm" loop documented in CERT Advisory CA-1996-01 (February 1996): an attacker forges a datagram whose source points to another host's UDP chargen service (port 19, or to another echo service), and the two services bounce traffic between each other in an unbounded loop that consumes all bandwidth on the link. CVE-1999-0103 covers this echo/chargen UDP packet-storm denial of service, and merely running the service is itself flagged as a configuration weakness (CVE-1999-0635). Neither CVE appears in CISA's Known Exploited Vulnerabilities catalog, and 7/udp is not a high-factor amplifier compared with DNS or NTP, but its presence on an internet-facing host is flagged immediately by vulnerability scanners (Nessus ECHO.NASL, OpenVAS). The service is disabled by default on every modern OS — Windows ships it only as the optional, not-installed "Simple TCP/IP Services" feature; Linux/BSD leave it commented out in inetd/xinetd; Solaris has disabled it by default since Solaris 10 (2005) — so a responsive 7/udp today usually signals a legacy or unhardened host, a network device with small-servers left on, or a router relaying Wake-on-LAN magic packets, and it should be closed and firewall-blocked.
- IANA assignment
echo— "Echo"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 7/tcp + 7/udp (7/sctp also listed); udp row identical to tcp row [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, rows 16 tcp / 17 udp)- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 7/tcp ≈ 0.004855; 7/udp ≈ 0.024679 (de-facto) [Well-established] — nmap-services file. No verified live Shodan/Censys count for 7/udp specifically was found; expected very low given default-disabled posture and firewall blocking[Likely] — https://data-status.shodan.io/ports.html
- Related ports
- 19 (chargen — the ping-pong partner), 9 (discard), 13 (daytime), 17 (qotd); 7/tcp sibling
Primary use
echo back the data of each received UDP datagram for testing/measurement (RFC 862)
Other/unofficial uses
application-layer reachability/latency testing (e.g. echoping); Wake-on-LAN magic packets sometimes relayed to UDP 7 across subnets/VLANs by routers and hobby relays
Security implications
UDP echo participates in the echo-chargen "ping-pong" / UDP packet-storm loop (CERT CA-1996-01, Feb 1996; CVE-1999-0103, CVSS v2 5.0); merely running the service is flagged as a configuration weakness (CVE-1999-0635, CVSS v2 0.0); abused in fraggle-style UDP floods; no encryption or authentication (plaintext, trivially spoofed); neither CVE is in CISA KEV; TCP echo is NOT a reflection vector (handshake required); disable as part of small-services hardening
Typically seen on
legacy Unix hosts, Cisco IOS small-servers, printers/embedded devices, router Wake-on-LAN relays
- Analyst note
- An open 7/udp today usually means an unhardened legacy host, a device with small-servers on, or a WoL relay; it is a packet-storm/fraggle liability and a scanner finding — close it and firewall-block it.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| echo | UDP | — | 2.47% |
| echo | TCP | — | 0.49% |
| echo | SCTP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.