What Runs on Port 351
Port 351 is officially assigned to MATIP-Type B (Mapping of Airline Traffic over Internet Protocol, Type B). Both TCP and UDP use this port to carry high-priority airline operational data—reservations, ticketing, and messaging traffic.12
MATIP exists because airlines built massive computer systems in the 1960s and 1970s on proprietary protocols that had nothing to do with the Internet. When the Internet became the backbone of global communication, airlines needed a way to keep their legacy systems running while talking to IP networks. MATIP is that bridge.
How MATIP Works
MATIP wraps airline-specific protocols in IP packets. It handles two types of traffic:3
Type A (port 350): Real-time query/response. High priority, minimal protection. Can be discarded if the network is congested. Think of it as the express lane.
Type B (port 351): High-level protection, multi-addressing, four levels of priority. This is the traffic that cannot be lost—reservations being confirmed, tickets being issued, critical operational messages.
The protocol is deliberately minimalistic. It doesn't try to rebuild the entire airline messaging system. It just wraps the existing data streams in IP packets and sends them on their way.
The History
RFC 2351 standardized MATIP in May 1998.4 Before that, airlines were stuck running parallel networks—one for their legacy systems, one for the Internet. MATIP meant they could consolidate.
But here's the strange part: IANA records show that port 351 TCP was already in widespread use before the official assignment. Something called "bhoetty" was registered on May 21, 1997, with a note: "unassigned but widespread use."5 Nobody seems to remember what bhoetty was. It's a ghost in the port registry—evidence that someone was already solving this problem before the RFC was written.
By 1998, MATIP-Type B took over port 351 officially, and bhoetty faded into obscurity.
Why This Port Matters
Every time you book a flight online, there's a chance your reservation is flowing through systems that predate the Internet. Port 351 is one of the doors that keeps those systems alive. Airlines don't rebuild their reservation infrastructure every decade—they adapt it. MATIP is that adaptation.
The airline industry runs on legacy systems that work. Port 351 is why they can keep working in a world that speaks IP.
Security Considerations
Port 351 has been flagged in the past as being exploited by trojans for command-and-control communication.6 This doesn't mean MATIP itself is insecure—it means attackers sometimes use well-known ports to blend in with legitimate traffic.
If you're running airline systems, port 351 should only accept connections from trusted sources. If you're not in the airline industry and see traffic on port 351, investigate it.
How to Check What's Listening
On Linux or macOS:
On Windows:
If something is listening on port 351 and you're not running airline reservation software, find out what it is.
Related Ports
- Port 350: MATIP-Type A (real-time query/response traffic)
- Port 3351: Used by some airline systems for related services
Frequently Asked Questions
Was this page helpful?