9
Summary
- // if you see it open
- Low risk in itself. Should be disabled as part of small-services hardening. Note that UDP 9 traffic is often Wake-on-LAN (magic packets), not the discard service; on Windows the Simple TCP/IP Services discard service can bind UDP 9 and interfere with WoL listeners.
- // analyst note
- An open discard is usually a benign legacy/small-services artifact; close it for hygiene. UDP 9 traffic may be Wake-on-LAN rather than the discard service.
About port 9/tcp.
Port 9/tcp is registered with IANA as discard with the description "Discard," assignee Jon Postel, and a blank reference field; it is dual-registered on TCP and UDP, and the registry additionally lists 9/sctp and 9/dccp (the latter citing [RFC4340], service code 1145656131), while Nmap labels the port "sink null." The protocol, defined in RFC 863 (Postel, May 1983), is the network equivalent of /dev/null: the server accepts data and throws it away, sending no response, on both TCP and UDP. It was designed as a debugging and measurement aid — somewhere to send traffic when you only care about the sending side. The IANA reference field for the classic registration is blank. The discard service itself is low-risk, but the port is worth a page mainly because of a de-facto overlap: UDP port 9 is the conventional destination for Wake-on-LAN "magic packets." Wake-on-LAN has no formal RFC and is keyed on a MAC-based magic packet rather than a port, but those packets are typically sent to UDP port 0, 7, or 9 (or directly over Ethernet as EtherType 0x0842); on Windows, the "Simple TCP/IP Services" discard service can bind UDP 9 and interfere with WoL listeners. As one of the "small services," discard was historically enabled by default in inetd and on Cisco IOS, and the modern recommendation is to disable it for hygiene. For an analyst, an open discard is usually a benign legacy or small-services artifact rather than a threat, and UDP 9 traffic may well be Wake-on-LAN rather than the discard service — but it should still be closed where it is not needed.
- IANA assignment
discard— "Discard"; reference (blank for tcp/udp; 9/dccp cites [RFC4340]); assignee Jon Postel; dual-registered 9/tcp + 9/udp (also 9/sctp, 9/dccp) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 9/tcp ≈ 0.003764; 9/udp ≈ 0.015733 (de-facto) [Well-established] — nmap-services file
- Related ports
- 7 (echo), 13 (daytime), 17 (qotd), 19 (chargen); UDP 9 ↔ Wake-on-LAN
Primary use
discard received data (the network /dev/null), RFC 863
Other/unofficial uses
UDP 9 is the de-facto Wake-on-LAN magic-packet destination port
Security implications
low risk in itself; disable as part of small-services hardening; UDP 9 traffic may be WoL rather than discard
Typically seen on
legacy Unix, Cisco IOS small-servers, embedded devices; WoL relays on UDP 9
- Analyst note
- An open discard is usually a benign legacy/small-services artifact; close it for hygiene. UDP 9 traffic may be Wake-on-LAN rather than the discard service.
About port 9/udp.
Port 9/udp is registered with IANA as discard with the description "Discard," assignee Jon Postel, and a blank reference field; the row is identical to the 9/tcp registration (the port is dual-registered on TCP and UDP, and the registry separately lists 9/sctp and 9/dccp). It is one of the original "small services" defined in RFC 863 (Postel, ISI, May 1983): a UDP discard server throws away the data of every datagram it receives and sends nothing back — the network equivalent of /dev/null. It was designed purely as a debugging and measurement aid, a place to send traffic when only the sending side matters. The IANA reference field is blank; RFC 863 defines the protocol but is not cited in the registry row, so no reference is asserted there. The reason 9/udp earns its own page is a de-facto overlap rather than the discard service itself: UDP port 9 is the conventional destination for Wake-on-LAN "magic packets." Wake-on-LAN has no formal RFC and is keyed on a MAC-based magic packet rather than a port, but those packets are usually sent to UDP port 0, 7, or 9 (or directly over Ethernet as EtherType 0x0842), and many consumer routers forward a magic packet arriving on UDP/9 from the internet to the local broadcast address to wake a sleeping host. The security weight here is mostly absent in the obvious place and present in a subtle one. Because a discard server returns zero bytes, its amplification factor for a spoofed-source reflection attack is effectively zero — an attacker gains nothing by aiming traffic at a discard listener, which makes UDP/9 a poor reflector compared with DNS, NTP, or SSDP. The real exposure is the Wake-on-LAN forwarding path: if a router relays external UDP/9 to the LAN broadcast address, an unauthenticated attacker on the internet can wake (but not otherwise control) hosts, and Wake-on-LAN itself carries no authentication, so the mitigation is to restrict by source IP or disable the forwarding rule. The discard service is disabled by default on modern systems, so for an analyst an open discard is usually a benign legacy or small-services artifact, and UDP/9 traffic may well be Wake-on-LAN rather than the discard service — but it should still be closed and firewall-blocked where it is not explicitly needed.
- IANA assignment
discard— "Discard"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 9/tcp + 9/udp (also 9/sctp, 9/dccp); udp row identical to tcp row [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, 9/udp row:discard,9,udp,Discard,[Jon_Postel],[Jon_Postel],,,,,,)- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 9/tcp ≈ 0.003764; 9/udp ≈ 0.015733 (de-facto) [Well-established] — nmap-services file (https://nmap.org/book/nmap-services.html). No verified live Shodan/Censys count for 9/udp specifically was found; exposed discard instances are indexed but prevalence is low given the default-disabled posture[Likely] — Wireshark wiki DiscardProtocol (https://wiki.wireshark.org/DiscardProtocol)
- Related ports
- 7 (echo), 13 (daytime), 17 (qotd), 19 (chargen); 9/tcp sibling; UDP 9 ↔ Wake-on-LAN
Primary use
discard (silently throw away) the data of each received UDP datagram, sending no response — the network /dev/null, for debug/measurement (RFC 863)
Other/unofficial uses
UDP 9 is the de-facto Wake-on-LAN magic-packet destination port; consumer routers may forward a magic packet arriving on UDP/9 to the LAN broadcast address to wake sleeping hosts
Security implications
low risk in itself; because the service returns zero bytes its DDoS reflection/amplification factor is effectively 0 (a poor reflector vs DNS/NTP/SSDP); the real exposure is the Wake-on-LAN forwarding path — if a router relays external UDP/9 to the LAN broadcast, an unauthenticated attacker can wake (not control) hosts, and WoL has no authentication (mitigate by source-IP restriction or disabling the rule); an open discard listener can also act as a bandwidth sink or liveness probe; disable as part of small-services hardening [Well-established/Threat-reported] — RFC 863 (zero-response behavior); CISA UDP-amplification alert (https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks)
Typically seen on
legacy Unix hosts, Cisco IOS small-servers, embedded devices; WoL relays on UDP 9
- Analyst note
- An open discard is usually a benign legacy/small-services artifact; close it for hygiene. UDP 9 traffic may be Wake-on-LAN rather than the discard service. Discard is a near-zero-amplification reflector, so the WoL-forwarding path — not reflection — is the exposure to check.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| discard | UDP | sink null | 1.57% |
| discard | TCP | sink null | 0.38% |
| discard | SCTP | sink null | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.