TACACS+ — the AAA protocol network gear uses to authenticate and authorise every command an admin types.
IANA registers 49 as the Login Host Protocol (TACACS); the protocol actually deployed on it is TACACS+, specified in RFC 8907, which routers, switches and firewalls use to check administrator logins, authorise individual commands, and log accounting records against a central server. Unlike RADIUS it separates authentication, authorisation and accounting and can gate per-command execution, which is why enterprise network teams standardise on it. Its body obfuscation is an MD5-based keyed scheme, not real cryptography, so RFC 8907 states it must run over a secured transport or a trusted network. A listener on 49 means a TACACS+ server such as tac_plus.
Do not expose
This is the authentication and authorisation plane for network infrastructure, protected by a shared secret and weak obfuscation; it belongs on a management network only.
$ nc -vz TARGET 49Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.