CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Network services

Port 19: Chargen

Character generator test service.

19

How Chargen works

Network services
client:19any!"#$%&'()*+ client:19any!"#$%&'()*+

The client sends a request to port 19 and the Chargen service answers. It travels in clear text: anyone on the path can read it.

Transport
UDP · TCP
Exposure risk
6/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
Network services
01 Security

Is port 19 dangerous?

Common attacks and weaknesses

  • UDP chargen is a DDoS amplification vector.

How to secure it

  • Disable it; it has no modern use.
02 Registry

IANA registry entries for port 19

ServicePortTransportDescriptionReferenceUpdated
chargen 19 TCP, UDP Character Generator - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 19, and is it reachable?

Linux

sudo ss -ltnup 'sport = :19'      # process listening on 19
sudo lsof -nP -i :19

macOS

sudo lsof -nP -i :19

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 19 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 19
netstat -ano | findstr :19

From another machine

nmap -p 19 -sV <host>
sudo nmap -sU -p 19 <host>
nc -zv <host> 19

Block it in the firewall

sudo ufw deny 19/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 19" -Direction Inbound -LocalPort 19 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 19 used for?

Character generator test service.

Is port 19 TCP or UDP?

Port 19 is registered for UDP and TCP.

Is it safe to open port 19?

It is rated 6/10 (high) when exposed to the Internet. UDP chargen is a DDoS amplification vector. Disable it; it has no modern use.

How do I check if port 19 is open?

On Linux run "ss -ltnup 'sport = :19'", on macOS "lsof -nP -i :19", and on Windows "netstat -ano | findstr :19" to see the local process. From another machine, "nmap -p 19 <host>" shows whether it is reachable.

05 Related
:53 DNS tcp · udp · moderate risk :135 MS RPC tcp · udp · high risk :123 NTP udp · tcp · moderate risk :67 DHCP server udp · tcp · moderate risk :111 rpcbind tcp · udp · high risk :9100 Raw printing (JetDirect) tcp · udp · high risk :631 IPP / CUPS tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk

Latest vulnerability news

All news