911

Port 911 is registered with IANA as xact-backup with the description "xact-backup," assignee Bill Carroll, and a blank reference field on both the TCP and UDP rows (verified against the live registry CSV). It is a backup-related service with minimal public documentation; the registered name and assignee are the substantive authoritative facts, and there is no defining RFC or widely available protocol specification. The IANA reference field is blank. Because the registration is sparse and the service is obscure, the registered name should not be assumed to reflect whatever is actually listening on the port in any given case. Security-wise there is no modern protocol security profile attached to the registration; SpeedGuide and SANS list a Windows 9x/98/ME-era trojan or backdoor ("Dark Shadow") historically associated with TCP 911, which should be treated only as threat-reported and not as verified current activity, and the "911" number occasionally draws opportunistic scanning. For an analyst, an open 911 is obscure and legacy — the right move is to investigate the host's backup software directly and identify the actual listening process rather than trusting the registered name; prevalence is very low. Confidence is Medium here because, while the IANA registration is confirmed, there is little corroborating documentation about the protocol's real-world behavior.

IANA assignment

xact-backup — "xact-backup"; reference (blank); assignee Bill Carroll; dual-registered 911/tcp + 911/udp [IANA-assigned, verified live] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

very rare; nmap-services de-facto low [Well-established] — nmap-services file

Related ports

other backup-related ports (contextual)

Primary use

backup-related service (minimal public documentation)

Other/unofficial uses

none meaningful [Likely]

Security implications

no modern protocol security profile; historical "Dark Shadow" trojan flag

Typically seen on

backup systems (legacy/obscure)

Analyst note

An open 911 is obscure/legacy — investigate the host's backup software directly and identify the actual listening process rather than trusting the registered name.