9418

Port 9418/tcp is registered with IANA as git with the description "git pack transfer service," assignee and contact [Linus_Torvalds], and a registration date of September 2005; the entry is dual-registered on TCP and UDP with identical rows, and the IANA Reference field is blank (no RFC governs the assignment). In practice the port carries Git's native transport, spoken by git daemon (the git-daemon server bundled with core Git) and reached through git:// remote URLs. The native protocol is the simplest and often fastest of Git's transports, but it is unauthenticated and unencrypted by design: any client that can reach the port may clone the exposed repositories, and because there is no TLS an on-path attacker can tamper with the transferred pack data — an integrity concern that becomes a code-execution concern when the fetched source is later built or run. That security posture is why GitHub permanently removed support for the unauthenticated git:// protocol on port 9418 platform-wide on March 15, 2022, steering users to https:// or SSH transports; the change affected GitHub-hosted repositories only and did not alter the IANA assignment or other self-hosted git-daemon deployments. For an analyst, an open 9418 usually means a self-hosted anonymous Git server. Internet-facing git-daemon instances are a recognized scanning and reconnaissance target — mass scanners probe 9418 for open, anonymously cloneable repositories that sometimes leak source code or secrets — so common guidance is to restrict the port to trusted networks or a VPN via firewall rather than exposing it publicly. It remains a legitimate service where anonymous read access is intended, unlike the small-services cluster, so context (is anonymous clone expected here?) drives the verdict.

IANA assignment

git — "git pack transfer service"; reference (blank — no RFC cited in IANA registry); assignee/contact [Linus_Torvalds]; registration date 2005-09; dual-registered 9418/tcp + 9418/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached copy, the IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered (1024–49151)

IANA Reference / RFC

none — no RFC governs the assignment; the registry Reference column is blank [Confirmed] — IANA registry (blank as-is)

Related ports

Git over SSH (22/tcp) and Git over HTTPS (443/tcp) as the authenticated/encrypted alternative transports

Primary use

Git native transport — git daemon / git-daemon server reached via git:// URLs; unauthenticated, unencrypted, often the fastest Git transport

Common software

git daemon (bundled with core Git) as the server; any standard git client using a git:// remote as the client

Security implications

no authentication or encryption by design → anyone reachable can clone; no TLS → on-path pack-data tampering (integrity / downstream code-execution risk); internet-facing git-daemon is a known scanning target for open, anonymously cloneable repos; standard hardening is firewall/VPN restriction

Typically seen on

self-hosted anonymous Git servers; developer infrastructure intended for public/anonymous read access

Dated event

2022-03-15 — GitHub removed support for the unencrypted/unauthenticated git:// protocol on port 9418 platform-wide (GitHub-hosted repos only; not a change to the IANA assignment or self-hosted deployments) [Confirmed] — github.blog changelog

Analyst note

An open 9418 is a legitimate anonymous-Git service where that access is intended; treat it as a potential source/secret exposure only when anonymous clone is unexpected, and prefer firewall/VPN restriction over public exposure.

Port 9418/udp is registered with IANA under the service name git, description "git pack transfer service," assignee Linus Torvalds, and a registration date of 2005-09, with a blank reference field (no RFC is cited). The registration is a dual tcp/udp assignment: 9418/tcp carries an identical entry (same service name, description, and assignee), and in practice the port belongs to Git's native transfer protocol. That protocol is the git:// scheme, served by git-daemon, and it is fundamentally TCP-oriented — the daemon listens on TCP 9418 and streams pack data to clients doing anonymous, unauthenticated, read-only clones and fetches. It was the workhorse behind fast public cloning for open-source hosts (kernel.org mirrors, Savannah/GNU, and historically GitHub). The UDP registration exists alongside the TCP one in the IANA registry, but there is no known standard Git service that actually operates over UDP 9418; any real git:// traffic rides TCP. For an analyst, the security-relevant fact is that git:// carries no authentication and no encryption, so it is exposed to man-in-the-middle content substitution — an attacker on the path can alter the repository contents served to a client, a supply-chain and code-execution risk — and anyone who learns the repository path can read it. Those were GitHub's stated reasons for deprecating the unauthenticated protocol, with the final brownout on 2022-03-15; that deprecation is GitHub-specific, and self-hosted git-daemon instances elsewhere may still serve the port. Treat an open 9418 as a probable git-daemon (on TCP); a distinct, documented UDP-9418 service could not be verified and should not be assumed.

IANA assignment

git — "git pack transfer service"; reference (blank — no RFC cited in IANA registry); assignee Linus Torvalds; registered 2005-09; dual-registered 9418/tcp + 9418/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151) [Confirmed] — port number 9418

Prevalence

Unknown — no dated, sourced internet-scan prevalence statistics specific to 9418/udp were found this pass [Unknown]

Related ports

9418/tcp (identical registration; the port git:// actually uses); 22/tcp (git over SSH), 443/tcp (git over HTTPS) as authenticated/encrypted alternatives

Primary use

Git native transfer protocol (git://), served by git-daemon for anonymous, unauthenticated, read-only clone/fetch — fundamentally TCP-oriented

Other/unofficial uses

git-daemon bundled with core Git; historically GitHub, Savannah/GNU, and kernel.org mirrors for anonymous git:// clone access

Security implications

git:// has no authentication and no encryption/TLS → man-in-the-middle content substitution (supply-chain/code-execution risk) and unrestricted read of any discoverable repo path; GitHub's stated reasons for deprecation

UDP-specific use

Unknown — no sourced, dated evidence of a distinct standard Git service over UDP 9418 separate from the TCP git-daemon protocol; treated as an honest null [Unknown]

Deprecation status

GitHub deprecated the unauthenticated git:// protocol, final brownout 2022-03-15; GitHub-specific — other hosts / self-hosted git-daemon may still support it [Confirmed] — blog.readthedocs.com GitHub git-protocol deprecation; github.com/cli/cli discussion #5349

Analyst note

An open 9418 is most likely a TCP git-daemon; UDP-9418 as a live service is unverified. Any git:// exposure is unauthenticated and unencrypted — flag it as a MitM/supply-chain and read-access risk.