98
Summary
- // if you see it open
- Low modern relevance: both the registered service (TAC News) and the de-facto service (linuxconf) are defunct/undocumented. linuxconf was deprecated by Red Hat after version 7.0 (~2000) and is absent from modern distributions. An open 98/tcp or 98/udp today is unusual and warrants investigation as a legacy/unmaintained host or a non-standard service squatting on an old well-known port. No CVE or named malware family is authoritatively tied to port 98 in the sources checked; generic 'used by trojans' claims appear only on low-quality aggregator sites without a primary source and are not asserted.
- // analyst note
- The IANA name (tacnews) and the de-facto tooling (linuxconf on tcp) diverge. Treat an open port 98 as a legacy/unmaintained-system signal or a non-standard service on an old well-known port; do not assume a specific live service.
About port 98/tcp.
Port 98/tcp is registered with IANA as tacnews with the description "TAC News," assignee and contact listed as Jon Postel, and a blank reference field — it is dual-registered on both TCP and UDP under the same name. "TAC News" is a relic of the early IANA port registry from the ARPANET-era Terminal Access Controller (TAC) lineage; no governing RFC exists, the Reference column is empty, and the service is undocumented and effectively defunct today. Because the assignee is Jon Postel — who curated the registry rather than authoring a protocol — the entry is best read as an early-registry name reservation, not a live specification. What makes port 98 interesting to an analyst is a divergence between the official name and de-facto tooling: nmap-services labels 98/tcp primarily as linuxconf (with a comment preserving the IANA tacnews name), reflecting Red Hat Linux's old linuxconf remote system-administration tool, which listened on TCP 98 before it was deprecated after Red Hat Linux 7.0 (circa 2000). 98/udp, by contrast, keeps the IANA tacnews name in nmap-services. Neither the tacnews service nor linuxconf is present on modern systems, so an open 98/tcp or 98/udp today is unusual and warrants investigation as a legacy/unmaintained host or a non-standard service squatting on an old well-known port. SANS Internet Storm Center tracks live scanning against port 98 and applies the same split labels (linuxconf for tcp, TAC News for tcp/udp), but publishes only a constantly-changing daily snapshot of scanner sources rather than a fixed historical count — so any specific scan volume is a live observation, not a stable fact. No CVE or named malware family is authoritatively tied to port 98 in the sources checked; generic "used by trojans" claims appear only on low-quality aggregator sites without a primary source and are not asserted here.
- IANA assignment
tacnews— "TAC News"; reference (blank — no RFC cited in IANA registry); assignee/contact Jon Postel; dual-registered 98/tcp + 98/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry-265)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 98/tcp ≈ 0.000088 (labeled linuxconf); 98/udp ≈ 0.000560 (labeled tacnews) [Likely] — nmap-services file
- Related ports
- legacy remote-administration and terminal-access services; contrast modern admin tooling (SSH/HTTPS control panels)
Primary use
"TAC News" (tacnews) — an early-IANA-era news/terminal-access relic; no governing RFC; undocumented and effectively defunct
Other/unofficial uses
de-facto linuxconf (Red Hat Linux remote system-administration tool) on 98/tcp, deprecated after Red Hat Linux 7.0 (~2000); 98/udp retains the tacnews name
Security implications
low modern relevance — both the registered service (TAC News) and the de-facto service (linuxconf) are defunct; an open 98/tcp/udp today is anomalous and worth investigating as a legacy host or non-standard squatter. No CVE or named malware family is authoritatively tied to port 98; "trojan" claims trace only to low-quality aggregators
Typically seen on
legacy Red Hat Linux hosts running old linuxconf (tcp); otherwise an anomaly
- Analyst note
- The IANA name (tacnews) and the de-facto tooling (linuxconf on tcp) diverge. Treat an open port 98 as a legacy/unmaintained-system signal or a non-standard service on an old well-known port; do not assume a specific live service.
About port 98/udp.
Port 98/udp is registered with IANA under the service name tacnews with the description "TAC News," listing Jon Postel as both assignee and contact and leaving the Reference, Registration Date, and Modification Date columns blank. The name is a relic of the early ARPANET era — "TAC" refers to the Terminal Access Controller, the packet-switching front-end hardware that let terminals dial into the ARPANET, and "TAC News" was a news/announcement distribution service associated with that environment. The registry entry is name-only: there is no linked RFC or protocol specification, so IANA does not formally document the wire protocol, and no first-party registration date is published (this is a port assignment, not an RIR RDAP record, so no allocation date exists to record — the blanks stay blank rather than being invented). Worth flagging for analysts is that 98/udp and 98/tcp are not the same service: while the cached IANA CSV shows tacnews on both transports, nmap's canonical nmap-services file lists 98/tcp as linuxconf (the Linuxconf remote-administration listener), so the two protocols on port 98 should not be conflated. No actively maintained software implementing tacnews over UDP could be identified, and Internet-scan frequency data shows the port is very rarely observed open — nmap-services records 98/udp at ≈0.000560 and 98/tcp at ≈0.000088, both well below common-service prevalence. No CVEs, malware campaigns, or honeypot reports specific to 98/udp were found in this pass; the practical takeaway is that a live listener on this legacy port is statistically unusual and worth investigating rather than assuming it is a normal, widely-deployed service.
- IANA assignment
tacnews— "TAC News"; assignee Jon Postel; contact Jon Postel; Reference blank; Registration Date / Modification Date blank in the registry [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml- Range class
- well-known (0–1023) [Confirmed]
- Registration date
- Unknown — the IANA registry does not display a registration or modification date for this legacy entry; not fabricated [Unknown] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
- IANA reference/RFC
- blank — no RFC is cited in the registry for tacnews [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
- Prevalence
- nmap-services open-frequency 98/udp ≈ 0.000560; 98/tcp ≈ 0.000088 — very low, consistent with a legacy/rarely-deployed service [Likely] — https://svn.nmap.org/nmap/nmap-services
- Related ports
- 98/tcp (linuxconf, a distinct service)
Primary use
legacy early-Internet news/announcement distribution associated with ARPANET-era TAC (Terminal Access Controller) environments; name-only registration with no documented wire protocol
Common software
Unknown / none identified — no maintained implementation of a tacnews UDP service was found; secondary port-reference sites merely restate the IANA name
Security implications
no CVEs, malware, honeypot reports, or scanning campaigns specific to 98/udp were located; general scanner/honeypot commentary does not mention port 98. Because 98/tcp's linuxconf lineage had known remote-admin weaknesses when exposed, any unexpected listener on port 98 should be treated as legacy/anomalous and investigated rather than assumed benign — but no documented current-day exploitation of 98/udp was found
Typically seen on
not characterized — a live tacnews UDP listener is rare/anomalous; treat as legacy or investigate
- Dual-registration note
- the cached IANA CSV lists tacnews on both 98/tcp and 98/udp (identical row content); however nmap-services lists 98/tcp as
linuxconf, so on the TCP side the observed/de-facto service differs — do not conflate the two[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry; https://svn.nmap.org/nmap/nmap-services - Analyst note
- An open 98/udp is statistically rare and tied to an obscure ARPANET-era assignment with no protocol spec — treat live traffic as noteworthy/legacy rather than a known widely-used service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| tacnews | UDP | TAC News | 0.06% |
| linuxconf | TCP | tacnews | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.