UDP 520
Synopsis
- UDP port 520 is used by the Routing Information Protocol (RIP) for IPv4 route updates (RIPv1 and RIPv2).
- Network gear from Cisco IOS, Juniper Junos, MikroTik RouterOS, and Huawei VRP uses UDP/520 when RIP is enabled.
- Open-source routing suites such as FRRouting’s ripd (and its predecessor Quagga/Zebra), as well as XORP and the historical GateD, implement RIP over UDP/520.
- Unix systems historically shipped routed/in.routed daemons that speak RIP on UDP/520; BSD variants still include legacy support.
- Windows Server’s Routing and Remote Access Service (RRAS) includes a RIP component that listens and advertises on UDP/520.
- Firewall/router distributions like pfSense and OpenWrt can run FRRouting/Quagga ripd and use UDP/520 for RIP.
- Security note: RIPv1 lacks authentication and RIPv2 is often misconfigured; attackers have used UDP/520 for RIP spoofing/route poisoning and limited reflection/amplification in DDoS, so it’s typically filtered at network edges.
Observed activity
Last 30 days
Detailed chart