Port 1867: UDRIVE — A Registered Ghost

What This Port Is

Port 1867 sits in the registered port range (1024–49151). These ports are assigned by the Internet Assigned Numbers Authority (IANA) to specific services on request — they're not reserved like the well-known ports below 1024, but they're recorded so that applications can find a stable, named home.¹

IANA lists port 1867 as assigned to a service called udrive, on both TCP and UDP.²

That's where the trail ends.

The "udrive" Registration

There is no RFC for udrive. No open-source implementation. No vendor documentation. No stack overflow thread where someone says "I'm using udrive on port 1867." The name appears in the IANA registry and in port database aggregators that scrape the registry — and nowhere else.

This happens more than you'd expect. Someone registers a port for a protocol they intend to build, or for internal software that never goes public, or for a product that gets cancelled. The registration persists. The protocol doesn't.

If you see traffic on port 1867 on your network, it almost certainly isn't udrive. It's more likely:

• Application-specific traffic from software that chose this port arbitrarily
• Malware or scanning activity probing registered-but-obscure ports
• A VPN or tunnel endpoint using a non-standard port to avoid firewall filtering
• A misconfigured service that landed here by accident

Checking What's on This Port

If port 1867 is open on a machine you're investigating:

On Linux/macOS:

# See what process is listening on port 1867
ss -tlnp | grep 1867
# or
lsof -i :1867

On Windows:

netstat -ano | findstr :1867

Then match the process ID to a process name using Task Manager or tasklist.

With nmap (scanning a remote host):

nmap -sV -p 1867 <target-ip>

The -sV flag attempts service version detection — it'll tell you what's actually running, not just that the port is open.

Why Unresolved Registrations Matter

The registered port range is large — over 48,000 ports — and IANA doesn't actively prune registrations that go nowhere. This means there are hundreds of ports like 1867: officially named, practically inert.

This matters for security. An "officially registered" port isn't inherently safe. If you see unexpected traffic on port 1867 — or any registered port with no clear explanation — treat it the same way you'd treat traffic on an unknown port. Find the process. Understand the source. Don't assume the IANA name means anything about what's actually running.