92

Port 92/tcp is registered with IANA as npp, description "Network Printing Protocol," with the contact listed as Louis Mamakos and a blank Reference field; the assignment is dual-registered on both TCP and UDP (92/tcp and 92/udp carry the identical service name and description). NPP was an early network print protocol from the pre-modern-Internet era: it predates the print stacks an analyst encounters today, and unlike LPD/LPR (515/tcp) or IPP (631/tcp) it has no accompanying RFC in the IANA registry and never saw broad deployment. That absence of a Reference is a genuine registry fact, not an oversight to be papered over with a guessed RFC. For a working analyst the practical takeaway is that port 92 is effectively a legacy assignment: no mainstream printing software — CUPS, Windows print spooler, LPD, or IPP — is documented as using it in normal operation, so a live listener here does not map to a common product. Broad internet scanners still sweep it the way they sweep most low, unused ports; SANS Internet Storm Center's port-92 dashboard shows the routine opportunistic probe traffic typical of any rarely-open port rather than NPP-specific exploitation. One point of caution: a secondary port-lookup source conflated UDP/92 with SNMP Trap, but that is wrong — SNMP Trap lives on 162/udp, and IANA lists 92/udp as npp exactly like 92/tcp. Treat an open port 92 as unusual and worth identifying rather than as a recognized service.

IANA assignment

npp — "Network Printing Protocol"; Reference (blank — no RFC cited in IANA registry); contact Louis Mamakos; dual-registered 92/tcp + 92/udp (identical service name and description) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; local cached the IANA Service Name and Transport Protocol Port Number Registry lines 252-253

Range class

well-known (0–1023) [Confirmed]

Registration/modification dates

blank in the cached registry — Unknown (not fabricated) [Unknown] — IANA registry entry (Registration Date and Modification Date columns empty)

Related ports

modern network-printing cluster — LPD/LPR 515/tcp, IPP 631/tcp; contrast with this legacy assignment

Primary use

Network Printing Protocol — an early/legacy network print protocol; no RFC, not widely deployed on the modern Internet

Common software

Unknown — no mainstream printing stack (CUPS, IPP 631, LPD/LPR 515, Windows print spooler) is documented as using port 92 in normal operation [Unknown]

Exposure/scanning

SANS ISC port-92 page shows routine opportunistic scan traffic consistent with generic broad-range scanners, not NPP-specific targeting; the page is a live dashboard so only the general pattern (not specific IPs/counts) is stable

Correction to secondary sources

one third-party lookup conflated UDP/92 with SNMP Trap; SNMP Trap is 162/udp — IANA lists 92/udp as npp, so that association is an error and should be disregarded [Confirmed] — IANA registry

Analyst note

A live port 92 is uncommon and does not map to a known product; identify the listener rather than assuming a standard printing service.

Port 92/udp is registered with IANA as npp with the description "Network Printing Protocol," assignee and contact Louis Mamakos, and a blank reference field (dual-registered on TCP and UDP — 92/tcp carries the identical service name, description, assignee, and contact, all with the same blank date and reference columns). This is a legacy well-known registration dating to the early 1990s that saw negligible real-world adoption; NPP is not a protocol in active use on the modern internet, and no mainstream printer firmware, operating-system daemon, or spooler software was found binding to UDP/92 for the registered service. A recurring analyst trap here is confusing NPP with the far more common Internet Printing Protocol (IPP), which is an entirely distinct IANA registration on port 631 — the two share a superficial "network printing" name but are unrelated protocols. Because 92 is a low port number it does receive routine internet background-scan traffic like most of the well-known range, and SANS Internet Storm Center tracks source-IP counts against it, but no port-92-specific campaign, CVE, or named malware family could be corroborated from a primary source. Some older port-lookup databases append a boilerplate "used by a Trojan" line to this and many other uncommon ports; that claim is unsourced and is reported here as unverified rather than as a documented threat. For an analyst, a responsive UDP/92 is best treated as an obsolete registration and an anomaly worth a second look, not as evidence of a specific known service.

IANA assignment

npp — "Network Printing Protocol"; reference (blank — no RFC cited in IANA registry); assignee/contact Louis Mamakos; dual-registered 92/tcp + 92/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cached CSV lines 252/253; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml)

Range class

well-known (0–1023) [Confirmed]

Registration/modification date

blank in the IANA registry — reported as-is, not inferred [Confirmed] — IANA registry (Reference/Date columns empty)

Primary use

legacy Network Printing Protocol; functionally obsolete with no confirmed modern implementation

Common software

none identified binding to UDP/92 for NPP; third-party port databases document the registration but no active implementation

Exposure/scanning

receives routine internet background-scan traffic like most low ports; SANS ISC tracks port-92 source-IP counts but shows no port-92-specific campaign

Malware association

an unverified "used by a Trojan" boilerplate claim appears on some legacy port-database sites; no CVE, named family, or dated incident corroborates it

Do-not-confuse

NPP (port 92) is unrelated to the Internet Printing Protocol (IPP) on port 631 [Confirmed] — https://en.wikipedia.org/wiki/Internet_Printing_Protocol

Analyst note

treat a responsive UDP/92 as an obsolete registration and an anomaly to investigate, not as a known active service.