# WHATPORT(49)

## NAME

port 49 — TACACS+ — TACACS+ — the AAA protocol network gear uses to authenticate and authorise every command an admin types.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA registers 49 as the Login Host Protocol (TACACS); the protocol actually deployed on it is TACACS+, specified in RFC 8907, which routers, switches and firewalls use to check administrator logins, authorise individual commands, and log accounting records against a central server. Unlike RADIUS it separates authentication, authorisation and accounting and can gate per-command execution, which is why enterprise network teams standardise on it. Its body obfuscation is an MD5-based keyed scheme, not real cryptography, so RFC 8907 states it must run over a secured transport or a trusted network. A listener on 49 means a TACACS+ server such as tac_plus.

## EXPOSURE

**Do not expose.** This is the authentication and authorisation plane for network infrastructure, protected by a shared secret and weak obfuscation; it belongs on a management network only.

## CHECK

```sh
nc -vz TARGET 49
```

## SEE ALSO

- spec — [RFC 8907 — The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol](https://www.rfc-editor.org/rfc/rfc8907.html) (rfc-editor.org)
- spec — [RFC 1492 — An Access Control Protocol, Sometimes Called TACACS](https://www.rfc-editor.org/rfc/rfc1492.html) (rfc-editor.org)
- source — [event-driven-servers (tac_plus / tac_plus-ng) source repository](https://github.com/MarcJHuber/event-driven-servers) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/49/> · JSON: <https://whatport.net/49.json> · full dataset: <https://whatport.net/ports.json>