79

Port 79/tcp is registered with IANA as finger with the description "Finger," assignee David Zimmerman, and a blank reference field (dual-registered on TCP and UDP; the registry carries an "unauthorized use" note referencing RFC 4146, which is not in the reference field). The Finger User Information Protocol is defined in RFC 1288 (December 1991, D. Zimmerman), which obsoleted RFCs 1196, 1194, and 742. The protocol returns information about users on a host: the client opens a TCP connection to port 79, sends a one-line query — a specific username, or a blank line for all logged-in users — and the Remote User Information Program (typically fingerd) replies in plaintext with details such as login name, full name, terminal, idle time, home directory, and the contents of the user's .plan and .project files. The finger program itself was written in 1971 by Les Earnest at Stanford. The IANA reference field is blank. Finger's place in security history is outsized: the Morris Worm, released on 2 November 1988, used a stack buffer overflow in fingerd (an unsafe gets() call overflowed by a crafted ~536-byte string on 4.3BSD VAX systems) as one of its propagation vectors, alongside a sendmail debug-mode hole and rsh/rexec trust relationships. Within about 24 hours roughly 6,000 of the ~60,000 then-connected internet hosts were affected — on the order of 10% of the early internet — and the incident produced the first conviction under the Computer Fraud and Abuse Act and the founding of CERT. Finger is also a textbook user-enumeration and information-disclosure service and supports query relaying (user@host@victim); RFC 1288 itself warns that finger is one of the avenues for direct penetration, as the Morris worm demonstrated. It is largely disabled today. For an analyst, an open 79 signals a legacy or unhardened host leaking user information and should be treated as reconnaissance exposure and disabled.

IANA assignment

finger — "Finger"; reference (blank — no RFC cited in IANA registry); assignee David Zimmerman; "unauthorized use" note re: RFC 4146 (not the reference field); dual-registered 79/tcp + 79/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low-to-moderate open-frequency in nmap-services (de-facto) [Well-established] — nmap-services file

Related ports

11 (systat / "Active Users", similar disclosure), 43 (WHOIS — shared NAME/FINGER lineage)

Primary use

return user information (login, name, idle, .plan/.project) — RFC 1288

Other/unofficial uses

legacy presence/recon utility [Well-established]

Security implications

Morris Worm (Nov 1988) fingerd buffer-overflow propagation vector; user-enumeration/information-disclosure; query relaying (user@host@victim); RFC 1288 explicitly warns of penetration risk; largely disabled today

Typically seen on

legacy/unhardened Unix hosts

Analyst note

An open 79 signals a legacy/unhardened host leaking user information; treat as reconnaissance exposure and disable.

Port 79/udp is registered with IANA under the service name finger with the description "Finger," assignee and contact David Zimmerman, and a blank reference field in the registry row — dual-registered alongside 79/tcp with identical fields. The catch for an analyst is that the UDP assignment is a paper mirror only: RFC 1288 (D. Zimmerman, December 1991, "The Finger User Information Protocol," obsoleting RFC 1196/1194/742) defines Finger exclusively over TCP — "Finger is based on the Transmission Control Protocol, using TCP port 79" — and specifies no message format for UDP at all. The UDP entry exists because IANA historically assigned both transports together, not because any wire protocol runs there. Finger itself returns user information (full names, login times, idle status, and often plan/project files) for a queried user, which made it a classic information-disclosure and social-engineering source on the TCP side; Unix fingerd (BSD lineage) was the canonical server and the finger command the client, but the service is now removed or disabled by default on essentially all modern distributions. Because there is no legitimate UDP Finger protocol, any UDP/79 traffic in the wild is scanning noise, a misconfigured client, or malware reusing the well-known number — SANS ISC documents historical trojan associations on port 79 (Back Orifice 2000 data port, CDK, Firehotcker). SANS ISC currently rates port 79 threat level "green" (low), with modest daily scanning. The IANA registry flags "Unauthorized use reported" with a pointer to RFC 4146 (the finger: URI scheme / mail context). For an analyst, the practical posture is identical on both transports: block 79/tcp and 79/udp at the firewall and disable fingerd if present; treat any UDP/79 observation as illegitimate by definition.

IANA assignment

service name finger — "Finger"; assignee and contact David Zimmerman; reference field blank (no RFC cited in the registry row); dual-registered 79/tcp + 79/udp with matching fields [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 183, 79/udp); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Range class

well-known (0–1023) [Confirmed] — port number 79

IANA Reference column

blank — registry lists no RFC for port 79 (the blank is genuine and intentional; RFC 1288/742 define Finger historically but are not in the registry Reference column) [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Assignment notes

IANA records "Unauthorized use reported" with reference to RFC 4146 (finger: URI / mail context) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 183)

Related ports

79/tcp (the actual Finger transport); the small/legacy-services cluster (7, 11, 13, 17, 19)

Primary use

name-based mirror reservation; no defined UDP protocol — RFC 1288 specifies Finger over TCP only, so UDP/79 carries no standardized behavior

Common software

Unix fingerd (BSD lineage) on the TCP side; finger CLI client; no software implements Finger over UDP; widely removed/disabled by default on modern systems

Other/unofficial uses

historical trojan associations on port 79 — Back Orifice 2000 data port, CDK, Firehotcker (malware reusing the number, not UDP Finger)

Exposure/scanning

SANS ISC threat level "green" (low); modest daily scanning observed; any UDP/79 traffic is opportunistic scanning, misconfiguration, or malware covert channel

Security implications

TCP-side Finger leaks user info (enumeration, social-engineering fodder, historical fingerd CVEs); UDP-side has no legitimate protocol surface; block both transports at the firewall and disable fingerd

Defining RFC

RFC 1288 (December 1991, D. Zimmerman), "The Finger User Information Protocol," obsoletes RFC 1196/1194/742; TCP-only [Confirmed] — https://datatracker.ietf.org/doc/html/rfc1288

Analyst note

79/udp is a registry mirror with no wire protocol — any observed UDP/79 traffic is illegitimate by definition (scan, misconfig, or malware); investigate, don't expect a service.