94
Summary
- // if you see it open
- unknown — no port-94-specific CVE or honeypot data found in this pass. Legacy niche IBM Tivoli service, rarely legitimately open on the modern public internet; an unexpected open port 94 most plausibly indicates a legacy Tivoli node or an anomaly to investigate. No dated risk figure asserted.
- // analyst note
- An open port 94 most plausibly indicates a legacy IBM Tivoli systems-management node; disregard the aggregator "IPP" claim (IPP is 631). No dated risk figure is asserted because none could be verified.
About port 94/tcp.
Port 94/tcp is registered with IANA as objcall with the description "Tivoli Object Dispatcher," with Tom Bereiter listed as both assignee and contact, and blank Registration Date, Modification Date, and Reference fields (dual-registered on TCP and UDP — 94/udp carries the identical service name, description, and contact). The Tivoli Object Dispatcher is a component of IBM's older Tivoli Management Framework, the systems-management platform where an object-request-broker-style dispatcher (the "oserv" lineage) brokered calls between managed nodes and the management server. This makes port 94 a niche, largely legacy enterprise-management service rather than a mainstream general-purpose protocol, and it is uncommon on the modern public internet. The IANA registry cites no RFC or other reference for this entry, so the Reference field stays blank — there is no port-specific standards document to point to. Several third-party port-lookup aggregators additionally describe port 94 as being used for "IP Printer Protocol (IPP)" or generic printer/web traffic, but that claim does not appear in the IANA registry, is not traceable to any primary source, and conflicts with the fact that IPP's actual IANA-registered port is 631 — so it should be treated as unverified aggregator noise, not fact. The nmap-services dataset does carry a measured open-frequency for this port — 94/tcp at approximately 0.000025, one step above the dataset's lowest nonzero step — but no port-94-specific honeypot reports or CVE history surfaced in this research pass; the port is not among the commonly cited high-scan-volume ports, so security posture is best summarized as "legacy niche service, rarely legitimately open today; an unexpected open port 94 warrants identifying the host as an IBM Tivoli node or investigating it as an anomaly" rather than asserting any dated risk figure.
- IANA assignment
objcall— "Tivoli Object Dispatcher"; assignee and contact Tom Bereiter; Registration Date, Modification Date, and Reference all blank in the registry; dual-registered 94/tcp + 94/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)- Range class
- well-known (0–1023) [Confirmed]
- IANA Reference / RFC
- none — no RFC or reference listed; column stays blank (not fabricated) [Confirmed] — IANA registry
- Registration / Modification date
- none on file — both blank in the registry; recorded as Unknown rather than an invented date [Confirmed] — IANA registry
- Prevalence
- nmap-services observed open-frequency 94/tcp ≈ 0.000025 — one step above the dataset's lowest nonzero step (0.000013) [Confirmed] — nmap-services dataset; sibling 94/udp ≈ 0.000428, roughly seventeen times higher. Both are negligible; the port is not among commonly referenced high-scan ports
- Related ports
- contrast IPP's real registration at 631/tcp (the mistaken aggregator association)
Primary use
Tivoli Object Dispatcher, a systems-management dispatcher component associated with IBM's legacy Tivoli Management Framework; niche/legacy enterprise use [Likely] — IANA description + IBM Tivoli product lineage (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)
Other/unofficial uses
some third-party aggregators (SpeedGuide, ports.my-addr.com, portsmaster.net) claim "IP Printer Protocol (IPP)" / printer use on port 94; NOT in the IANA registry, uncorroborated by any primary source, and conflicts with IPP's real port 631 — treat as unverified
Security implications
Unknown — no port-94-specific CVE, honeypot, or Shodan/Censys data found; legacy niche service, rarely legitimately open today [Unknown]
Typically seen on
legacy IBM Tivoli Management Framework nodes; otherwise an anomaly worth identifying
- Analyst note
- An open port 94 most plausibly indicates a legacy IBM Tivoli systems-management node; disregard the aggregator "IPP" claim (IPP is 631). No dated risk figure is asserted because none could be verified.
About port 94/udp.
Port 94/udp is registered with IANA as objcall with the description "Tivoli Object Dispatcher," with Tom Bereiter listed as both assignee and contact, and blank Registration Date, Modification Date, and Reference fields. The entry is dual-registered across transports: the 94/tcp row carries the identical service name, description, and contact, so the UDP side is not a distinct protocol assignment but the companion transport of the same reservation. The Tivoli Object Dispatcher is a component of IBM's older Tivoli Management Framework, the systems-management platform in which an object-request-broker-style dispatcher (the "oserv" lineage) brokered calls between managed nodes and the management server. That makes port 94 a niche, largely legacy enterprise-management service rather than a mainstream general-purpose protocol, and it is uncommon on the modern public internet. The IANA registry cites no RFC or other reference for this entry, so the Reference field stays blank — there is no port-specific standards document to point to. Some third-party port-lookup aggregators additionally describe port 94 as "IP Printer Protocol (IPP)" or generic printer/web traffic, but that claim does not appear in the IANA registry, is not traceable to any primary source, and conflicts with the fact that IPP's actual IANA-registered port is 631 — so it should be treated as unverified aggregator noise, not fact. The nmap-services dataset does record a very low open-frequency for this port — about 0.000428 for 94/udp against about 0.000025 for 94/tcp — but beyond that figure no port-94-specific exposure statistics, honeypot reports, or CVE history surfaced in this research pass. One UDP-specific caveat matters for an analyst: UDP scanning is inherently ambiguous, so an "open|filtered" or apparently responsive UDP port 94 is at least as likely to be a scan artifact (absence of an ICMP unreachable) as a live Tivoli service. The honest security posture is therefore "legacy niche service, rarely legitimately open today; an unexpected UDP port 94 warrants confirming it as an IBM Tivoli node or treating it as a scan artifact or anomaly to investigate" rather than asserting any dated risk figure.
- IANA assignment
objcall— "Tivoli Object Dispatcher"; assignee and contact Tom Bereiter; Registration Date, Modification Date, and Reference all blank in the registry; dual-registered 94/tcp + 94/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)- Range class
- well-known (0–1023) [Confirmed]
- IANA Reference / RFC
- none — no RFC or reference listed; column stays blank (not fabricated) [Confirmed] — IANA registry
- Registration / Modification date
- none on file — both blank in the registry; recorded as Unknown rather than an invented date [Confirmed] — IANA registry
- Prevalence
- nmap-services observed open-frequency 94/udp ≈ 0.000428 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 94/tcp side is rarer at ≈ 0.000025 [Confirmed] — nmap-services dataset; the port is not among commonly referenced high-scan UDP ports [Likely]
- Related ports
- 94/tcp (identical IANA registration, companion transport); contrast IPP's real registration at 631 (the mistaken aggregator association)
Primary use
Tivoli Object Dispatcher, a systems-management dispatcher component associated with IBM's legacy Tivoli Management Framework; niche/legacy enterprise use [Likely] — IANA description + IBM Tivoli product lineage (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)
Other/unofficial uses
some third-party aggregators (SpeedGuide, portsmaster.net) claim "IP Printer Protocol (IPP)" / printer use on port 94; NOT in the IANA registry, uncorroborated by any primary source, and conflicts with IPP's real port 631 — treat as unverified
Security implications
Unknown — beyond the nmap-services open-frequency figure, no port-94-specific CVE, honeypot, Shodan/Censys, or exposure data found; legacy niche service, rarely legitimately open today; UDP scanning is ambiguous so an apparent open may be a scan artifact [Unknown]
Typically seen on
legacy IBM Tivoli Management Framework nodes; otherwise an anomaly or UDP scan artifact worth identifying
- Analyst note
- An open UDP port 94 most plausibly indicates a legacy IBM Tivoli systems-management node or a UDP scan artifact; disregard the aggregator "IPP" claim (IPP is 631). No dated risk figure is asserted because none could be verified.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| objcall | UDP | Tivoli Object Dispatcher | 0.04% |
| objcall | TCP | Tivoli Object Dispatcher | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.