Port 1197: Carrius-rshell — The officially registered port that became an OpenVPN favorite

Port 1197 lives a double life. Officially, it belongs to carrius-rshell, a remote access protocol for managing Carrier Ethernet networks. In practice, it's one of the most common alternative ports for OpenVPN servers.

What Range This Port Belongs To

Port 1197 sits in the registered ports range (1024-49151). This range is managed by IANA—organizations can request specific port numbers for their protocols. Unlike well-known ports (0-1023) which require root privileges to bind, or dynamic/ephemeral ports (49152-65535) which are meant to be temporary, registered ports occupy the middle ground.

Registered ports provide enough structure to avoid chaos while remaining accessible to regular applications. Any application can listen on port 1197 without special privileges, which makes this range particularly flexible—and sometimes messy.

The Official Assignment: Carrius-rshell

IANA officially registered port 1197 for carrius-rshell¹, a remote terminal access protocol designed for managing Carrier Ethernet networks. The protocol enables network administrators to remotely connect to devices, perform configuration changes, monitor performance, and troubleshoot issues.

Carrier Ethernet is a set of technologies that extend Ethernet's capabilities for carrier-grade networks—the infrastructure that telecommunications companies use. Think enterprise-level network management for service providers.

Network equipment manufacturers use carrius-rshell in their management interfaces, providing a channel for remote administration of switches, routers, and other devices within Carrier Ethernet infrastructure.

Here's the thing: despite being the official registered service, carrius-rshell is relatively obscure. Most network administrators have never encountered it. The port's registration exists, the protocol exists, but its actual usage footprint is small.

The Unofficial Reality: OpenVPN

Port 1197 sees far more use as an alternative port for OpenVPN.

OpenVPN's default configuration uses UDP port 1194 and TCP port 443². But administrators frequently configure OpenVPN to use different ports—sometimes for security through obscurity, sometimes to bypass firewall rules, sometimes just to run multiple VPN servers on the same machine.

Port 1197 sits one digit away from 1194 and falls in a range that's typically open in enterprise networks. It's become a common choice for alternate OpenVPN configurations. Search any VPN forum and you'll find discussions about ports 1195, 1196, 1197, 1198—variations clustering around the default.

This isn't documented anywhere official. It's emergent behavior. Thousands of OpenVPN servers run on port 1197 right now, quietly doing their job, technically squatting on a port registered for something else.

Why Unassigned Ports Matter

This port illustrates why the port number system works the way it does. The three ranges serve different purposes:

Well-known ports (0-1023): Core Internet protocols. SSH, HTTP, SMTP. These need to be predictable and privileged.

Registered ports (1024-49151): Applications can claim a spot, but the claims aren't enforced. Carrius-rshell registered 1197, but nothing stops you from running OpenVPN there instead. This flexibility is a feature, not a bug.

Dynamic/ephemeral ports (49152-65535): Temporary assignments. When your browser connects to a web server, the operating system picks a random port from this range for your side of the connection.

The middle range—where port 1197 lives—balances order and chaos. Organizations can register ports to avoid conflicts, but the system remains permissive enough for real-world needs. If registered ports were rigidly enforced, the Internet would be less flexible. If they didn't exist at all, we'd have more collisions and confusion.

How to Check What's Listening

If something is using port 1197 on your system, here's how to find out what it is:

Linux/macOS:

sudo lsof -i :1197
# or
sudo netstat -tulpn | grep 1197

Windows:

netstat -ano | findstr :1197

This tells you whether port 1197 is in use and which process owns it. You might find carrius-rshell. You might find OpenVPN. You might find something else entirely.

The Gap Between Registration and Reality

Port 1197 isn't unusual. Many registered ports see more use from unofficial services than their registered owners. The port registry creates a loose framework, but actual Internet usage is messier and more pragmatic.

The registered service exists. The unofficial uses exist. Both are real. The port number is just an address—what actually lives there changes depending on who's running the server.

This is how the Internet works in practice: structured enough to function, loose enough to adapt.