Skip to content
ProtocolPorts

Port reference

Port 19 (UDP/TCP) – CharGEN

Character Generator — a legacy debugging service that emits a stream of characters in response to any input.

udptcpWell-known

Quick facts

Transport
udp, tcp
Category
Well-known
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Disabled on modern systems. Historically enabled via inetd on Unix and as a Simple TCP/IP Service on older Windows.

What is port 19 used for?

Port 19 runs the Character Generator Protocol (CharGEN), defined in RFC 864 as a network debugging and measurement aid. When it receives any input it replies with a stream of arbitrary characters, which old tools used to test throughput and print-out behaviour. It shipped with Unix's inetd and as a Windows Simple TCP/IP Service, but it has no real use on modern networks and is almost always left off.

When would you open it?

There is rarely a good reason to. The only practical scenario is reviving a piece of vintage equipment or running a deliberate test against legacy software that still speaks CharGEN. Only enable it if you specifically run that service and need it for testing.

Is it safe to open?

The big risk is that CharGEN's large replies make it an easy amplification source for DDoS attacks, so never expose it to the internet and keep it on a trusted LAN or VPN. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :19
nmap -p 19 <target>
Windows
netstat -ano | findstr :19
Test-NetConnection <host> -Port 19
macOS
lsof -i :19
nmap -p 19 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 19 to your device's local IP, internal port 19, protocol TCP/UDP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 19/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=19/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 19 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 19" -Direction Inbound -Protocol TCP -LocalPort 19 -Action Allow

Security & risks

Common attacks

  • UDP amplification / reflection DDoS
  • Resource exhaustion via paired echo (port 7) and chargen loops

Hardening

  • Disable CharGEN entirely — it has no modern use
  • Remove Simple TCP/IP Services on Windows and the chargen line from inetd/xinetd
  • Block UDP/TCP 19 at the network edge
  • Never expose chargen to untrusted networks

How to block this port

Linux (ufw)
sudo ufw deny 19/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=19/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 19 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 19" -Direction Inbound -Protocol TCP -LocalPort 19 -Action Block

nmap snippet

nmap -sU -p19 --script chargen <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 7Port 13Port 17Port 53

Frequently asked questions

What is port 19 used for?
Port 19 is the Character Generator (CharGEN) protocol, a 1980s debugging tool that replies to any packet with a stream of characters. It is obsolete and should be disabled.
Why is CharGEN a DDoS risk?
A small spoofed UDP request triggers a much larger reply, so open chargen servers are abused as reflectors/amplifiers to flood third-party victims.

Related guides