Internet-Security.com UDP port 512 details

UDP port 512 is used by the comsat (biff) new‑mail notification service on Unix-like systems.
Real implementations include comsat(8) on FreeBSD and NetBSD, comsatd on OpenBSD, and GNU Inetutils comsatd on Linux.
MTAs that can trigger these notifications include Postfix’s local(8) when “biff = yes” and BSD sendmail’s mail.local, which notify comsat upon local mailbox delivery.
Legacy Unix systems such as SunOS and HP-UX also shipped comsat for the biff(1) program to display terminal popups on new mail.
This was widely used on multiuser timesharing hosts and still appears in some BSD-derived environments.
Security: comsat on UDP/512 has had remote vulnerabilities and can enable user-enumeration; it has historically been scanned/abused, so it’s commonly disabled or firewalled today.

UDP 512