70

Port 70/tcp is registered with IANA as gopher with the description "Gopher," assignee Mark McCahill, and a blank reference field (dual-registered on TCP and UDP). The Gopher protocol is defined in RFC 1436 (March 1993; Anklesaria, McCahill, Lindner, Johnson, Torrey, and Alberti at the University of Minnesota, where the system was released in mid-1991). It is a menu-driven, hierarchical document-retrieval system: the client opens a TCP connection to port 70, sends a selector string followed by CRLF, and the server returns a menu or document terminated by a single period on its own line, then closes. Gopher predated and briefly competed with the World Wide Web before being largely superseded by HTTP, surviving today mainly as a small hobbyist "gopherspace." The IANA reference field is blank. The notable security story is not the service — which is rare — but the gopher:// URL scheme, which has become a significant Server-Side Request Forgery (SSRF) primitive. Because gopher:// lets a client emit raw, multi-line TCP payloads, attackers abuse it through SSRF-vulnerable applications (and tools such as curl) to talk to internal services: a crafted gopher:// URL can write a cron job or webshell into an exposed Redis instance to achieve remote code execution, or reach Memcached, MySQL/PostgreSQL, SMTP, FastCGI, or Zabbix; tools like Gopherus and SSRFMap automate generating these payloads. Mainstream browsers dropped Gopher support years ago (Internet Explorer in 2002 via MS02-047, Firefox 4.0 in 2011). For an analyst, an open 70 is almost always a deliberate retro/hobbyist gopher server; the larger operational concern is gopher:// appearing in SSRF exploitation against your own applications rather than the listening service itself.

IANA assignment

gopher — "Gopher"; reference (blank — no RFC cited in IANA registry); assignee Mark McCahill; dual-registered 70/tcp + 70/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

very low open-frequency in nmap-services (e.g. ~0.000226, de-facto) [Well-established] — nmap-services file

Related ports

80/443 (HTTP/HTTPS); gopher-SSRF targets 6379 (Redis), 11211 (Memcached), 25 (SMTP)

Primary use

menu-driven document retrieval (RFC 1436)

Other/unofficial uses

gopher:// as an SSRF payload-delivery scheme; hobbyist gopherspace [Well-established/Threat-reported]

Security implications

gopher:// SSRF primitive — smuggles raw TCP payloads to internal services (Redis→RCE, Memcached, MySQL, SMTP, FastCGI); automated by Gopherus/SSRFMap; browsers dropped Gopher (IE 2002 MS02-047, Firefox 4.0 2011)

Typically seen on

rare retro/hobbyist gopher servers

Analyst note

An open 70 is almost always a deliberate hobbyist gopher server; the bigger concern is gopher:// in SSRF exploitation against your apps, not the service.

Port 70/udp is registered with IANA as gopher with the description "Gopher," assignee Mark McCahill, and a blank reference field — a mirror of the identical 70/tcp registration that makes this a dual-registered port under the same assignee. The UDP assignment is a name reservation only: the protocol that actually defines Gopher, RFC 1436 (F. Anklesaria et al., University of Minnesota, March 1993), specifies TCP exclusively — "This protocol assumes a reliable data stream; TCP is assumed" — and defines no UDP transport. Gopher is a hierarchical, menu-based document search and retrieval protocol that originated at the University of Minnesota in 1991; a client connects, sends a selector string terminated by CRLF, and the server returns a menu or document. It was largely supplanted by HTTP and the World Wide Web by the mid-1990s, though a small enthusiast community still runs active Gopher servers (e.g. Gophernicus, Bucktooth) on 70/tcp. No known software listens on 70/udp in production: because no protocol handshake exists for it, Internet-wide scanners such as Shodan and Censys return negligible results, and any UDP traffic to port 70 is anomalous and most plausibly scanning noise. The security weight of port 70 is inherited from the TCP side rather than UDP-specific: Gopher's lack of encryption, authentication, and active maintenance, combined with gopher:// URI support in some HTTP clients, makes it a documented SSRF vector — an attacker who can coerce a server into fetching a gopher:// URL can craft raw TCP byte sequences to probe or attack internal services (Redis, Memcached, MySQL) behind a firewall, and some web filters that block HTTP/HTTPS pass Gopher because of its non-HTTP framing. For an analyst, 70/udp is a low-stakes entry: blocking it at the perimeter is standard, low-risk practice, and a responsive or scanned 70/udp warrants curiosity rather than a service assumption.

IANA assignment

gopher — "Gopher"; reference (blank — no RFC cited in the IANA registry for this entry); assignee Mark McCahill; dual-registered 70/tcp + 70/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 165; 70/tcp at line 164)

Range class

well-known (0–1023) [Confirmed]

Prevalence

negligible on UDP — no handshake exists, so Shodan/Censys-style scanners elicit no response; 70/tcp hosts a small enthusiast server population [Likely] — Internet-wide scanning literature; security guidance recommends blocking port 70 (TCP+UDP) unless Gopher is explicitly required

Status

obsolete / IANA-name-only for UDP; Gopher (TCP) originated 1991, standardized in RFC 1436 (1993), supplanted by HTTP by the mid-1990s; small active enthusiast community as of 2024 [Confirmed] — RFC 1436; Wikipedia (Gopher protocol)

Related ports

70/tcp (the real Gopher service); contrast HTTP/HTTPS (80/443) which supplanted Gopher

Primary use

IANA name reservation only — mirrors the 70/tcp Gopher assignment; no protocol RFC defines a UDP transport for Gopher

Protocol definition

Gopher is defined in RFC 1436 (Anklesaria et al., Univ. of Minnesota, March 1993), which mandates TCP; UDP/70 has no protocol-defined use

Other/unofficial uses

none known on UDP; Gopher clients and servers (Gophernicus, Bucktooth) use 70/tcp exclusively

Security implications

no UDP/70-specific exploitation is documented (no protocol uses it; UDP traffic to port 70 is anomalous scanning noise). Inherited from 70/tcp: SSRF via gopher:// URIs (raw-byte attacks on internal Redis/Memcached/MySQL), WAF/filter evasion via non-HTTP framing, and no encryption/authentication/active maintenance

Typically seen on

not observed as a live UDP service; scanning noise on UDP/70, a small enthusiast server population on 70/tcp

Analyst note

70/udp is a name reservation, not a live service. Treat any UDP/70 traffic as anomalous; the real Gopher attack surface (SSRF) lives on 70/tcp. Blocking port 70 at the perimeter is low-risk.