Port 1737: Ultimad — A Registered Ghost

What This Port Is

Port 1737 sits in the registered ports range (1024-49151). These are ports that applications and services can claim through IANA, the Internet Assigned Numbers Authority. Unlike the well-known ports below 1024 (which require root/administrator privileges to bind), registered ports are open to any application running as a normal user.

IANA records port 1737 as assigned to a service called "ultimad" on both TCP and UDP, registered to one Michael Lanzetta. ¹ That is the entirety of the official documentation. No RFC. No description. No link to a project, company, or specification.

It is a name in a database, and nothing else.

What "Ultimad" Appears to Be

No active software project, protocol documentation, or open-source repository bearing the name "ultimad" surfaces in public records. The registration is old enough that whatever it referred to — if it ever shipped at all — has left no visible trace on the modern Internet.

Some port databases have flagged port 1737 as historically associated with malware communication, a common fate for obscure registered ports that legitimate software never actively used. ² There is no named specific threat tied to it; the flag is more of a "we've seen traffic here from bad actors" annotation than a concrete attribution.

Why Ghost Registrations Exist

The IANA registered ports process is intentionally low-friction. A developer or company submits a request, provides a contact name and service name, and IANA records the assignment. There is no requirement to publish documentation, release software, or maintain the registration over time.

The result: thousands of ports like 1737 exist in the official registry as names without stories. They were claimed — sometimes optimistically, sometimes by projects that never launched, sometimes by companies that no longer exist. The number is reserved. The story was never told.

How to Check What's Using Port 1737 on Your System

If you see port 1737 in your network connections, the port registration tells you nothing. Check the process directly:

macOS / Linux:

# Show what process is listening on port 1737
lsof -i :1737

# Or with netstat
netstat -an | grep 1737

Windows:

# Show listening ports with process IDs
netstat -aon | findstr :1737

# Then look up the process ID
tasklist | findstr <PID>

If something is listening on port 1737 and you didn't put it there, find out what it is. The name "ultimad" will not help you — but the process ID will.