848
Summary
- // if you see it open
- IANA registers GDOI on TCP port 848. RFC 3547 discusses GDOI over UDP and specifies Phase 1 SA protection for GROUPKEY-PULL and Re-key SA protection for GROUPKEY-PUSH. The TCP registration alone does not establish that a host runs GDOI or that its service is safe.
- // common applications
- Secure multicastGroup communications using IPsec ESP RFC 3547 describes protected key-management exchanges between group members and a group controller/key server, with datagrams used to distribute or update group security associations.
About port 848.
IANA assigns TCP port 848 to GDOI, the Group Domain of Interpretation protocol for group key management. RFC 3547 says GDOI establishes and maintains security associations and distributes group keying material. These references describe the assignment and protocol, not whether a particular host runs it or whether it should be reachable from the public internet.
RFC 3547 describes GDOI as a group security association management protocol. In its protocol context, GROUPKEY-PULL lets a member retrieve group keys from a group controller/key server under a Phase 1 security association; GROUPKEY-PUSH datagrams from the controller/key server use a Re-key SA to protect messages that create or update group SAs. The RFC lists secure multicast applications and group applications without multicast transport. These are RFC protocol descriptions and do not establish deployment over TCP.
The evidence does not establish a recommended public access policy, current deployment, traffic prevalence, or malware association for 848/tcp. Treat the port number alone as insufficient to identify a listening service; verify the protocol and the host's intended role before drawing conclusions.
- Assignment
- IANA registers TCP port 848 as
gdoi, described as GDOI. [Confirmed] - Exposure
- Unknown; the supplied protocol and registry evidence do not establish whether public access is appropriate. [Unknown]
- Prevalence
- Unknown; no scoped traffic or deployment measurement is supplied. [Unknown]
- Malware
- Unknown; the supplied evidence does not assess malware associations. [Unknown]
- IANA service
gdoi[Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv- IANA description
- GDOI [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Protocol purpose
Group security association and key management
- Port guidance
- IANA registers GDOI on TCP port 848 [Confirmed]. RFC 3547's port guidance is specifically about UDP: it says GDOI must not run on UDP port 500 and assigns UDP port 848 — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv; https://www.rfc-editor.org/rfc/rfc3547.txt
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| gdoi | UDP | — | 0.03% |
| gdoi | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.