99
Summary
- // if you see it open
- No confirmed present-day malware or trojan association. Third-party port-database sites (SpeedGuide, adminsub.net, auditmypc.com, t1shopper) list port 99 under its IANA name with no active malware tie; auditmypc.com explicitly marks UDP 99 as not a virus/trojan port, noting a historical flag would reflect only past incidental trojan use, not current risk. No CVE or active-exploitation campaign specific to port 99/tcp was found.
- // analyst note
- An open port 99 is statistically rare with no known legitimate current service — treat as an anomaly and investigate; do not assume malware, as none is confirmed for this port.
About port 99/tcp.
Port 99/tcp is registered with IANA as metagram with the description "Metagram Relay" and a contact/assignee of Geoff Goodfellow, dual-registered on both TCP and UDP (99/tcp and 99/udp carry the identical service name, description, and assignee). The IANA reference field is blank — no RFC documents this assignment, and none should be invented for it; the entry is attributed to a named contact rather than a published standard. "Metagram Relay" is an early ARPANET/Internet-era experimental assignment that left almost no surviving technical trace: there is no IETF RFC defining its wire format, and it appears only in historical "Assigned Numbers" lineage and passing registry-housekeeping discussion (a 2003 IESG mailing-list thread references the "Metagram Relay Protocol (UDP & TCP Ports 99)," but that page returned 403 and its content is inferred only from search snippets, so treat any detail beyond its existence as unconfirmed). No current mainstream server or client software implements metagram on port 99; that field is an honest, sourced Unknown rather than a fabricated answer. For an analyst, port 99 matters mostly as an obscure historical registration rather than an active service. Third-party port-database references (SpeedGuide, adminsub.net, auditmypc.com, t1shopper) list it under its IANA name with no confirmed present-day malware or trojan association; auditmypc.com explicitly marks UDP 99 as not a virus/trojan port, noting only that any historical flag would reflect past incidental trojan use, not current risk. No CVE or active-exploitation campaign tied specifically to port 99/tcp was found in this pass, so a responsive port 99 is best treated as an anomaly worth investigating rather than a recognized standard service.
- IANA assignment
metagram— "Metagram Relay"; reference (blank — no RFC cited in IANA registry); assignee/contact Geoff Goodfellow; dual-registered 99/tcp + 99/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; local registry CSV lines 266 (tcp) and 267 (udp)- Range class
- well-known (0–1023) [Confirmed]
- Registration/modification date
- blank in the IANA registry — not recorded, no date fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (Registration Date / Modification Date columns empty)
- Related ports
- contrast with actively used well-known services; port 99 belongs to the pool of obscure historical single-contact registrations
Primary use
early/historical "Metagram Relay" assignment for both TCP and UDP; no IETF RFC defines its wire format, and it left essentially no trace in later networking literature
Common software
Unknown — no current mainstream server/client software implementing metagram on port 99 was found (sourced null, not fabricated) [Unknown]
Typically seen on
no known common host profile; a responsive port 99 is best treated as an anomaly
- Security/exposure
- no confirmed present-day malware or trojan association; auditmypc.com explicitly marks UDP 99 as not a virus/trojan port (historical flag = past incidental use only); no CVE or active-exploitation campaign tied specifically to port 99/tcp found [Likely] — https://www.auditmypc.com/udp-port-99.asp
- Historical reference
- a 2003 IESG mailing-list thread references the "Metagram Relay Protocol (UDP & TCP Ports 99)" [Likely — page returned 403, content inferred from search snippets only] — https://psg.com/~randy/lists/iesg/2003/msg07416.html
- Analyst note
- An open port 99 is statistically rare with no known legitimate current service — treat as an anomaly and investigate; do not assume malware, as none is confirmed for this port.
About port 99/udp.
Port 99/udp is registered with IANA as metagram with the description "Metagram Relay" and assignee Geoff Goodfellow; the reference field is blank, and the port is dual-registered on both TCP and UDP (99/tcp carries the identical service name, description, and assignee). Metagram Relay is a legacy ARPANET-era assignment: the service name and description appear in RFC 1010 ("Assigned Numbers," May 1987), which lists "METAGRAM — Metagram Relay" among the early host-to-host port assignments of that period, but the current IANA registry entry for port 99 carries no RFC reference of its own, so the reference field is left blank rather than backfilled with RFC 1010. No RFC defines the protocol's wire format or behavior — the assignment appears to be a reserved/allocated port-number entry rather than a protocol with a widely implemented, documented specification. For an analyst the practical picture is sparse: no actively maintained software is known to implement or listen on Metagram Relay, and the port is not a common target in current internet-wide scanning telemetry (unlike Telnet on 23 or SMB on 445). Low-authority port-lookup aggregators attach generic malware/trojan warning boilerplate to UDP 99, but no independently corroborated CVE, vendor advisory, or dated scanning-campaign report specific to 99/udp could be confirmed. Any inbound traffic to UDP 99 on a monitored network is atypical for legitimate use and worth a case-by-case look, but the port is best framed as a legacy IANA registration with no known modern usage rather than an active service or a known backdoor.
- IANA assignment
metagram— "Metagram Relay"; reference (blank — no RFC cited in IANA registry); assignee Geoff Goodfellow; dual-registered 99/tcp + 99/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; local registry CSV rows 266 (tcp)/267 (udp)- Range class
- well-known (0–1023) [Confirmed]
- Registration/modification dates
- blank in the source registry — left blank, not fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
- IANA reference
- blank — no RFC cited against this entry in the current registry; RFC 1010 corroborates the historical name but is not the registry's reference for this port [Confirmed] — IANA registry
- Related ports
- 99/tcp (identical metagram registration); other legacy small/early-era assignments
Primary use
legacy ARPANET-era "Metagram Relay" assignment; no RFC defines the protocol's wire format
Common software
Unknown — no sourced evidence of a current, actively maintained daemon implementing Metagram Relay [Unknown]
Security implications
Unknown / not independently verified — low-authority aggregators carry generic trojan boilerplate for UDP 99, but no corroborated CVE, vendor advisory, SANS ISC, or Shodan-sourced report specific to 99/udp was found; not a common modern scanning target [Unknown]
Typically seen on
no known modern deployment; inbound UDP 99 is atypical and worth case-by-case investigation
- Analyst note
- Frame as a legacy IANA-registered port with no known modern usage; do not characterize as a malware/backdoor port absent a verifiable, dated, sourced incident.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| metagram | UDP | Metagram Relay | 0.10% |
| metagram | TCP | Metagram Relay | 0.03% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.