UDP 1604

ProtocolUDP
Port1604
LabelsDarkComet remote administration tool (RAT)

Synopsis

  • Citrix ICA Browser (service name: icabrowser) uses UDP port 1604.
  • It’s used by Citrix MetaFrame, Presentation Server, and XenApp (including 5/6/6.5) clients such as Program Neighborhood/PNAgent/older Citrix Receiver to discover servers and enumerate published applications via broadcast.
  • Real-world example: In legacy XenApp 6.5 environments, clients send UDP 1604 queries to locate a Zone Data Collector and retrieve the application list; many enterprises historically allowed UDP 1604 between subnets for this purpose.
  • Modern Citrix deployments typically use the Citrix XML Service over HTTP/HTTPS instead, so UDP 1604 is mainly seen in older or legacy setups.

Observed activity

Last 30 days Detailed chart

More information