Port 1719: H.323 RAS — The Front Desk of Legacy Video Conferencing

Port 1719 is assigned to H.323 RAS — Registration, Admission, and Status. If H.323 is the language of legacy video conferencing, port 1719 is where endpoints go to check in, ask permission, and get their calls approved.

What Runs on This Port

H.323 is a protocol suite defined by the ITU-T in 1996 for carrying voice, video, and data over IP networks.¹ It predates SIP and was the dominant standard for enterprise video conferencing systems through the 2000s — the protocol behind Cisco CallManager, Polycom endpoints, and conference room systems the world over.

Within H.323, the RAS channel handles all the bookkeeping before a call begins. RAS stands for Registration, Admission, and Status, and it does exactly those three things:

• Registration — An endpoint announces itself to a gatekeeper: "I'm here, I'm H.323 capable, here's my address."
• Admission — Before placing a call, the endpoint asks permission: "Is there bandwidth? Is this destination allowed? Can I proceed?"
• Status — Ongoing health checks and updates between endpoint and gatekeeper.

None of this is the call itself. RAS is pure signaling — the conversation that has to happen before any voice or video can flow.

The Gatekeeper

The gatekeeper is the central authority in an H.323 network. Every endpoint in a "zone" registers with one gatekeeper. The gatekeeper knows who's online, resolves aliases to IP addresses, enforces bandwidth limits, and decides which calls are allowed.²

Think of it like a telephone switchboard operator who also controls the building's bandwidth budget. You don't dial directly — you ask the operator, the operator checks availability, and only then does the connection go through.

Port 1719 is the gatekeeper's window. Everything goes through it.

The Discovery Dance

Finding a gatekeeper involves a two-port ritual.³

First, the endpoint doesn't know where the gatekeeper is. So it shouts — it sends a Gatekeeper Request (GRQ) to the multicast address 224.0.1.41 on port 1718. This is literally a broadcast to any gatekeeper that might be listening on the local network.

The gatekeeper responds with a Gatekeeper Confirm (GCF), which includes its unicast address.

From that point on, all RAS messages go to the gatekeeper's unicast address on port 1719. The discovery phase used port 1718 once; everything after uses port 1719 forever.

It's a clean design: shout to find the room, then knock on the specific door.

How RAS Messages Work

RAS runs over UDP — it's low-overhead signaling that doesn't need the reliability guarantees of TCP. The message flow follows a request-confirm/reject pattern:

Each transaction is a question and an answer. The endpoint asks; the gatekeeper decides.

IANA formally registered port 1719 under two service names: h323gatestat (UDP) for the RAS signaling traffic, and h323gatedisc (TCP) for an alternate mode.⁴ In practice, UDP/1719 is what matters.

H.323 in Context

H.323 was published by the ITU in November 1996, derived from earlier ISDN videoconferencing standards.¹ It was the first VoIP standard to use RTP for media transport, which made it genuinely interoperable across vendors. For a decade, it was the protocol that made enterprise video work.

Then SIP arrived — simpler, text-based, easier to debug, more web-native. The industry migrated. By the 2010s, SIP had won. Most H.323 infrastructure was replaced or wrapped in compatibility layers.

Port 1719 still exists in legacy systems, older Cisco gear, and environments that haven't completed migration. If you're working in a corporate network with conference room systems from the early 2000s, you may still see RAS traffic on this port.

Security Considerations

H.323 and RAS were designed in an era before security was the primary concern. A few things to know:

No built-in authentication by default. Early H.323 implementations registered with gatekeepers with minimal verification. An attacker on the network could potentially register rogue endpoints or intercept RAS exchanges.

Firewall complexity. H.323 is notoriously firewall-unfriendly. The protocol negotiates dynamic ports for media, which means firewalls need ALGs (Application Layer Gateways) to track H.323 sessions and open the right holes. This complexity contributed to SIP's eventual dominance.

Outdated implementations. Systems still running H.323 are often old and unpatched. If you see port 1719 active on a modern network, it's worth investigating whether that system is receiving security updates.

Checking What's on This Port

# See if something is listening on 1719 (Linux/macOS)
ss -ulnp | grep 1719
netstat -ulnp | grep 1719

# On macOS
lsof -i UDP:1719

# Capture RAS traffic (requires tcpdump/Wireshark)
tcpdump -i any udp port 1719

# Nmap scan
nmap -sU -p 1719 <target>

If you see traffic on port 1719 in your network, it's almost certainly H.323 RAS — either a legacy video conferencing system, a Cisco gateway registering with a Call Manager, or a VoIP device from an earlier era.

Related Ports

• 1718/UDP — H.323 gatekeeper discovery (multicast GRQ)
• 1720/TCP — H.323 call signaling (H.225.0 call setup)
• 5060/UDP — SIP, the protocol that largely replaced H.323
• 5004/UDP — RTP, the media transport used by both H.323 and SIP