861

Port 861 is a transport split in the live IANA registry (verified against the canonical CSV): 861/tcp is registered as owamp-control with the description "OWAMP-Control" and reference [RFC4656], while 861/udp is registered as owamp-test with the description "OWAMP-Test Receiver Port" and reference [RFC8545]; both transports list assignee IESG and contact IETF Chair. OWAMP, the One-Way Active Measurement Protocol (RFC 4656, September 2006), measures one-way network performance — one-way delay, one-way loss, and jitter — between two hosts with high precision, and it splits into OWAMP-Control, which over TCP 861 negotiates, starts and stops, and fetches the results of test sessions with optional authentication or encryption, and OWAMP-Test, which sends timestamped test packets over UDP. Because OWAMP-Control requires TCP, the originally assigned UDP 861 was unusable for it, so RFC 8545 (March 2019, Morton and Mirsky) reallocated UDP 861 to OWAMP-Test while leaving the TCP assignment as it was and updated the assignee and contact for both transports to the IESG and IETF Chair — exactly the change applied to 862/TWAMP. The standard notes that the UDP receiver-port use is optional in Standards-Track OWAMP and TWAMP, and that OWAMP requires synchronized clocks (NTP, or higher-precision PTP/GPS sources, with RFC 8186 adding PTP timestamp support); TWAMP (RFC 5357, port 862) extended OWAMP to two-way measurement. Security-wise an exposed OWAMP endpoint can be used for reconnaissance, and an open UDP test port could in principle be abused for traffic generation or reflection if unprotected, so RFC 8545 recommends filtering access to the receiver port by access list and using a non-globally-routable address for the session-reflector; OWAMP supports authenticated and encrypted modes. For an analyst, an open 861/tcp almost always indicates a perfSONAR or ISP/research-network measurement node and pairs with 862; nmap open-frequency is low.

IANA assignment

861/tcp owamp-control — "OWAMP-Control" [RFC4656]; 861/udp owamp-test — "OWAMP-Test Receiver Port" [RFC8545] (the transports DIFFER); assignee [IESG], contact [IETF_Chair] (updated by RFC 8545) [IANA-assigned, verified live] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low; nmap-services de-facto low [Well-established] — nmap-services file

Related ports

862 (TWAMP control/test — the two-way extension); perfSONAR ecosystem (owampd/powstream/pScheduler)

Primary use

OWAMP one-way network-performance measurement (one-way delay, loss, jitter) (RFC 4656)

Other/unofficial uses

the measurement basis TWAMP (RFC 5357, port 862) extended to two-way [Well-established]

Security implications

can support reconnaissance; an exposed UDP test/receiver port could be abused for traffic generation/reflection — filter by ACL, use non-routable session-reflector address (RFC 8545 §6); authenticated/encrypted modes available

Typically seen on

perfSONAR/measurement nodes (ESnet, Internet2, GÉANT, university networks)

Analyst note

An open 861/tcp almost always indicates a perfSONAR or ISP/research-network measurement node — benign in that context, out of place on a general-purpose server; 861/udp traffic is OWAMP-Test data.