Port reference
Port 520 (UDP) – RIP (Routing Information Protocol)
Distance-vector routing protocol that exchanges route tables between routers over UDP.
Default state
Open on routers running RIP; RIPv1 has no authentication and RIPv2 auth is often left disabled.
Common attacks
- Route injection to redirect or blackhole traffic
- Spoofed RIP updates poisoning the routing table
- Man-in-the-middle via attacker-advertised routes
- Denial of service by injecting false or excessive routes
Hardening
- Prefer a modern protocol (OSPF) or static routes over RIP
- If RIP is required, use RIPv2 with MD5/cryptographic authentication
- Apply passive interfaces and ACLs to block RIP from untrusted segments
- Filter inbound UDP 520 at network edges and use route filters
nmap snippet
nmap -sU -p520 --script rip-info <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 520?
Port 520 (UDP) carries RIP, the Routing Information Protocol, a classic distance-vector routing protocol. Routers use it to advertise and learn routes by periodically exchanging their routing tables. RIPv1 offers no security at all; RIPv2 adds optional authentication but is frequently deployed without it. RIP is largely superseded by OSPF but still appears in small or legacy networks.
Why it matters for security
RIP's weakness is trust without verification. Because RIPv1 has no authentication and RIPv2 auth is often disabled, a router will believe routing updates from any host on the segment. An attacker who can inject updates rewrites where traffic flows — redirecting it through their machine for interception, dropping it (blackhole), or destabilizing the network. The blast radius is the entire routed path.
How it's attacked
An attacker on a connected segment forges RIP updates on UDP 520 advertising attractive (low-metric) routes. Routers accept the poisoned entries and update their tables, enabling man-in-the-middle interception, traffic blackholing, or denial of service by flooding bogus or excessive routes. With RIPv1 there is nothing to stop this; with unauthenticated RIPv2 it is just as easy.
Hardening checklist
Wherever possible, replace RIP with OSPF or static routes. If RIP is required, use RIPv2 with MD5/cryptographic authentication, configure passive interfaces so updates are not accepted on user-facing segments, and apply route filters and ACLs to limit which routes and neighbors are trusted. Filter inbound UDP 520 at network edges. The nmap snippet above queries RIP on devices you are authorized to test.
Related ports
Frequently asked questions
- Does RIP have authentication?
- RIPv1 has none at all. RIPv2 supports simple and MD5 authentication, but it is often left disabled, so RIP updates frequently travel unauthenticated and can be spoofed.
- How is RIP attacked?
- An attacker on the segment sends forged RIP updates on UDP 520 advertising attractive routes. Routers accept them and redirect traffic, enabling interception, blackholing, or denial of service.