Port 1334: writesrv — When messaging meant trusting everyone

Port 1334 carries writesrv, a service that enables users on remote Unix systems to send messages to users on the local machine using the write command. It's a messaging system from an era when networks were small, known, and trusted.

What writesrv Does

Writesrv allows remote users to interrupt your terminal session with a message. Someone on another machine can type:

write username@yourmachine

And their message appears on your screen, disrupting whatever you're doing. It's like someone walking up to your desk and tapping you on the shoulder—except they might be on the other side of the Internet.¹

The service was designed for engineers working on shared Unix systems, where quick communication between users was valuable. But that was when "remote" meant "down the hall," not "anywhere in the world."

The registered Port Range

Port 1334 sits in the registered port range (1024–49151). These ports are assigned by IANA to specific services upon request, though enforcement is looser than the well-known ports (0–1023).²

This middle range was meant for services that aren't universal but are common enough to need coordination. Writesrv qualified—it was widely deployed on IBM AIX systems and other Unix variants.

Security Considerations

Writesrv should be disabled on any system connected to a public network.³

The problem is trust. Writesrv was designed assuming good actors on trusted networks. It doesn't authenticate. It doesn't encrypt. It just accepts messages and displays them.

Worse, older versions had a buffer overflow vulnerability. An attacker could send a specially crafted message that crashed the service or potentially executed code. IBM released patches in 1997, but the fundamental issue remains: this service was never designed for hostile environments.⁴

Even if your version is patched, ask yourself: do you want random people on the Internet sending messages to your users' terminals?

Checking What's Listening

On Unix systems, you can check if writesrv is running:

# Check if port 1334 is listening
netstat -an | grep 1334

# On AIX specifically, check the service
lssrc -s writesrv

# See what process owns the port
lsof -i :1334

If you find writesrv running and you're not deliberately using it, disable it:

# On AIX
stopsrc -s writesrv
rmitab writesrv

The Bigger Picture

Ports like 1334 remind us how the Internet grew up. Services that made perfect sense on a university network in 1985 became liabilities when those networks connected to the wider world.

Writesrv exists because engineers wanted to talk to each other. The write command was social media before we had the term—ephemeral messages, real-time communication, interrupt-driven notifications. All the things we reinvented decades later, but without any concept of security or consent.

The question every open port asks is: who do you trust? In 1985, the answer might have been "everyone on the network." In 2026, if that's still your answer, you're probably not on the Internet very long.

Related Ports

• Port 513 (rlogin) — Another trust-based remote access service
• Port 514 (rsh/syslog) — Remote shell, or remote logging depending on protocol
• Port 2401 — An alternate port sometimes used by writesrv⁵