87
Summary
- // if you see it open
- Cleartext by design with no encryption, authentication, or access control. Classified as an unsafe port and blocked for HTTP requests by major browsers (Chrome, Firefox, Edge). No CVEs attach to ttylink itself. No sourced 2024-2025 Shodan/Censys exposure counts specific to 87/tcp were located. A modern host listening on 87 is anomalous and warrants investigation.
- // analyst note
- An open port 87 carries no legitimate modern service and is browser-blocked as unsafe — treat a live listener as an anomaly worth investigating.
About port 87/tcp.
Port 87/tcp is registered with IANA with the description "any private terminal link," assignee and contact both listed as Jon Postel, a blank service-name field, and no RFC reference (dual-registered identically on 87/tcp and 87/udp). The "any private" wording places port 87 in the band of low-numbered ports that early registry maintainers set aside for unspecified private/experimental use rather than a single standardized protocol — there is no IANA-assigned service name and no formal specification behind the entry. Outside the IANA registry the port is most often associated, by long-standing convention rather than by registry text, with ttylink (TTYLink): an ARPANET-era terminal-to-terminal chat facility in which two users on connected hosts opened a raw TCP connection and exchanged real-time text, with no negotiation or authentication beyond TCP's own handshake. That convention is recorded in community port lists (Wikipedia's port-number list, third-party port references) rather than in any IETF document, so it is reported here as likely-but-not-registry-confirmed. For an analyst the practical picture is simple: port 87 carries no modern legitimate service, transmits in cleartext by design, and is classified by major browsers (Chrome, Firefox, Edge) as an unsafe port that is blocked for HTTP requests. No CVEs attach to the ttylink convention itself, and no sourced 2024–2025 Shodan or Censys exposure counts specific to port 87 were located, so any host found listening on 87 should be treated as anomalous and worth investigating rather than assumed benign.
- IANA assignment
- blank service name; description "any private terminal link"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 87/tcp + 87/udp with identical fields [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 242–243; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt)
- Range class
- well-known (0–1023)
- Service name (`ttylink`)
- associated by convention, not by IANA registry (the registry service-name cell is blank) [Likely] — Wikipedia List of TCP and UDP port numbers; connected.app/ports/87
- Status
- legacy / effectively obsolete; IANA registration persists with no service name and no RFC reference [Confirmed] — IANA registry
- Related ports
- the small-services / legacy-terminal cluster (7, 9, 11, 13, 17, 19, 23 telnet); contrast modern encrypted remote access (22 SSH)
Primary use
historical TTYLink terminal-to-terminal real-time text chat over a raw TCP connection, ARPANET era; no handshake/authentication beyond TCP; an early precursor to IRC-style chat
Common software
described as originating on DEC TOPS-20 / PDP-10 era systems; no mainstream modern software uses this port
Security implications
cleartext by design, no encryption/authentication/access control; classified as an unsafe port and blocked for HTTP by major browsers; no CVEs tied to ttylink itself; an open port 87 on a modern host is anomalous
Exposure / scanning
no sourced 2024–2025 Shodan/Censys counts specific to 87/tcp were located [Unknown]
- Analyst note
- An open port 87 carries no legitimate modern service and is browser-blocked as unsafe — treat a live listener as an anomaly worth investigating.
About port 87/udp.
Port 87/udp is registered with IANA as "any private terminal link," with no service-name keyword in the registry CSV itself, a blank reference field, and assignee/contact both listed as Jon Postel — the entry is dual-registered identically on TCP (line 242) and UDP (line 243) of the IANA Service Name and Transport Protocol Port Number Registry. The "any private terminal" wording marks this as one of the legacy-era assignments Postel reserved for unspecified private use rather than a single named protocol; there is no RFC cited by IANA and none should be invented. In practice the port is associated with the ttylink family of terminal-to-terminal link services, and the Nmap services database labels it priv-term-l (ttylink). That historical ttylink concept is a plaintext terminal link: no authentication, no encryption, and no access control beyond the transport, which is why any service actually found listening here should be treated as high-risk. The UDP variant in particular carries no documented live software ecosystem — ttylink daemons, where they existed at all, historically listened on the TCP side — and the Nmap open-frequency for the port is extremely low (0.000125), so on a modern network UDP/87 sees virtually no legitimate traffic. For an analyst the practical posture is twofold: active exposure is negligible (open instances are rare and UDP scanning is itself unreliable, since a non-response is indistinguishable from filtered), but if a listener is ever confirmed it warrants investigation as a suspicious or backdoor-style service rather than a benign legacy daemon, given there is no contemporary legitimate use case and any traffic would be unencrypted.
- IANA assignment
- description "any private terminal link"; service-name keyword blank in the registry CSV; reference blank (no RFC cited); assignee and contact both Jon Postel; dual-registered 87/tcp + 87/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 242–243; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=87)
- Range class
- well-known (0–1023) [Confirmed]
- Service name (de-facto)
priv-term-l(ttylink) per Nmap services database [Confirmed] — https://svn.nmap.org/nmap/nmap-services- Prevalence
- Nmap-services open-frequency ≈ 0.000125 (extremely rare); not in Shodan's default scan set [Confirmed/Likely] — https://svn.nmap.org/nmap/nmap-services ; https://gist.github.com/s0md3v/3e953e8e15afebc1879a2245e74fc90f
- Registration / modification dates
- Unknown (registry lists none; not fabricated)
Primary use
legacy terminal-to-terminal link (ttylink) reserved as "any private terminal link"; UDP variant rarely if ever implemented
Common software
no current/maintained implementation; classic-Unix ttylink (split-screen terminal link) is the only historical association
Security implications
if any service runs here it has no authentication and no encryption (plaintext); negligible legitimate use today, so inbound attempts are commonly flagged as suspicious. Historical malware/trojan reuse is asserted by some security sources but no specific malware family is confirmed by a primary source — treat as unverified
Typically seen on
effectively nothing on modern networks; any listener is an anomaly worth investigating
- Analyst note
- UDP scanning is unreliable (no-response ≠ closed), so absence of a result is not proof the port is closed; a confirmed listener should be treated as a high-risk, likely-illegitimate service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| priv-term-l | TCP | any private terminal link, ttylink | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.