Port 1807: fhsp — Fujitsu's Ghost Protocol

What Port 1807 Is

Port 1807 sits in the registered ports range (1024–49151). These ports are assigned by IANA upon request from organizations that want a reserved home for their software. Unlike well-known ports (0–1023), registered ports don't require elevated system privileges to open, and they span most of the software you actually run day-to-day.

IANA records port 1807 as assigned to fhsp — the Fujitsu Hot Standby Protocol — on both TCP and UDP. The contact registered is Eiki Iwata of Fujitsu.¹

That's where the official record ends.

The Protocol That Left No Trace

Hot standby is a high-availability technique where a backup system sits ready to take over the instant a primary fails. "Hot" means the standby is live and synchronized; failover happens in seconds. The concept is well-understood, and many systems implement it.

Fujitsu's version, apparently, was internal. There is no public RFC, no published specification, no developer documentation, no forum post from a Fujitsu engineer explaining how fhsp works. The protocol was registered with IANA, which locked in the port number, and then it stayed inside Fujitsu's server infrastructure.

If you see port 1807 open on a machine that isn't running Fujitsu enterprise hardware, fhsp is almost certainly not why.

The Port Security Tools Actually Know

Security databases flag port 1807 for a different reason: SpySender, also catalogued as Backdoor.Delf.hp — a Windows remote access trojan that circulated in the early 2000s. The malware used port 1807 as its command-and-control channel on Windows 9x, NT, 2000, and XP systems.²

SpySender is effectively extinct on modern systems. But its port associations persisted in security tools and firewall rule sets, which is why 1807 still appears on threat-monitoring lists decades later.

How to Check What's Using Port 1807

If you see activity on port 1807 and want to know what's behind it:

On Linux or macOS:

sudo ss -tlnp | grep 1807
# or
sudo lsof -i :1807

On Windows:

netstat -ano | findstr :1807
# Then look up the PID:
tasklist | findstr <PID>

On any modern system, unexpected activity on port 1807 warrants a look. It won't be fhsp.

Why Ports Like This Exist

The registered ports range has over 48,000 slots. Not all of them contain living protocols. Some were claimed by products that never shipped, or shipped internally and never became public, or were abandoned without ever releasing the registration.

Port 1807 is one of those — officially occupied, practically empty. The IANA registry is a historical document as much as an operational one. It records what organizations intended, not always what survived.