Port 1798: Event Transfer Protocol — a name without a story

What Range This Port Belongs To

Port 1798 sits in the registered ports range (1024–49151). These ports are maintained by the Internet Assigned Numbers Authority (IANA), which accepts registrations from anyone with a protocol to name.

The registered range is different from the well-known ports (0–1023), which require IETF review and carry the foundational protocols of the Internet — HTTP, DNS, SSH, SMTP. Registered ports have a lower bar. Submit a request, name your service, get your number. No RFC required. No proof of deployment.

Port 1798 is the result.

What IANA Says

IANA lists port 1798 as "etp" — Event Transfer Protocol, assigned to a contact named Mike Wray, for both TCP and UDP.¹

That's where the documentation ends. There is no RFC defining Event Transfer Protocol. There is no open-source implementation, no vendor documentation, no Stack Overflow question about why it's blocked in a firewall. The name exists. The protocol, as far as anyone can find, does not.

This isn't unusual. The registered ports range contains hundreds of entries like this — claimed decades ago for software that never shipped, projects that dissolved, or internal tools that never needed external traffic. The registry accepted the name and moved on.

What's Actually Listening on Port 1798

In practice, nothing should be listening on port 1798 unless you or software you've installed put something there. If you see traffic on this port and don't recognize it, that's worth investigating.

To check what's using port 1798 on your system:

Linux / macOS:

sudo ss -tlnp | grep 1798
# or
sudo lsof -i :1798

Windows:

netstat -aon | findstr :1798

The output will show the process ID (PID) holding the port. Match that PID against your running processes to identify what's listening.

Why Unassigned-in-Practice Ports Matter

The gap between "registered" and "in use" matters for network security. Firewall rules often permit traffic on registered ports by name rather than by verified purpose. A port labeled "Event Transfer Protocol" in a registry might slip through a rule that blocks "unknown" ports — even though the protocol behind it is equally unknown.

Port 1798 is harmless as far as anyone knows. But it's a useful reminder: the registry is a list of claims, not a list of running services. Trust what you can verify, not what's been named.