Port 589 carries a specialized protocol with an unusual dual history—legitimate scientific research on one hand, and a cautionary security tale on the other.
What Runs on Port 589
Port 589 is officially assigned by IANA to EyeLink, a protocol used by eye-tracking research systems.1 EyeLink systems are specialized hardware and software tools used in psychology, neuroscience, and human-computer interaction research to precisely track where subjects are looking, how long their gaze fixates, and how their eyes move during experiments.
The protocol allows EyeLink eye-tracking hardware to communicate with research computers over TCP/UDP port 589, transmitting real-time gaze data, calibration information, and experimental control commands.
The Security Shadow
While EyeLink is the legitimate assignment, port 589 gained notoriety in the early 2000s as one of the ports used by the Assasin backdoor trojan.23 This backdoor gave attackers unauthorized remote access to infected computers, turning port 589 into a point of entry rather than a research data stream.
The Assasin trojan (sometimes spelled "Assassin" in various security databases) would listen on port 589, waiting for commands from a remote attacker. Security monitoring systems still flag unexpected traffic on port 589 as potentially suspicious because of this historical association.
This dual identity shows something important: any port can be weaponized. The same port that carries eye movement data for a vision science lab can be hijacked for unauthorized access. The port number itself is neutral—what matters is what's listening.
Well-Known Ports and Assignment
Port 589 falls in the well-known ports range (0-1023), which is reserved for system services and can only be bound by privileged processes on Unix-like systems. Well-known ports are assigned by IANA to specific protocols and services.
However, many well-known port assignments refer to protocols that are rarely used in practice. EyeLink is a perfect example—it's a legitimate, specialized research tool, but you won't find it on most networks. The vast majority of computers will never run EyeLink software or connect to eye-tracking hardware.
This creates gaps. A port that's officially assigned but rarely used becomes attractive to malware authors looking for a place to hide. Port 589's story is this gap made visible.
Checking What's Listening
If you want to see what's actually using port 589 on your system:
On Linux/macOS:
On Windows:
If you see something listening on port 589 and you're not running EyeLink eye-tracking software, investigate. It could be legitimate software that happens to use this port, or it could be something you didn't install intentionally.
Why Unassigned and Rarely-Used Ports Matter
The Internet has 65,535 possible ports (per protocol). IANA has assigned thousands of them to specific services. But the reality is that most networks only actively use a small handful—HTTP (80), HTTPS (443), SSH (22), DNS (53), and a few dozen others.
This leaves thousands of officially assigned but practically dormant ports. They exist in the registry. They have official purposes. But they're quiet.
And that quiet is exactly what makes them interesting—both to specialized legitimate tools that need a stable port number, and to malware that wants to operate in the shadows of rarely-monitored ports.
Port 589 is a reminder: the port registry is a map of intentions, not necessarily a map of reality. What's actually running on any given port is an empirical question.
The Research Context
For the researchers who actually use port 589 legitimately, it's infrastructure. Eye-tracking research has contributed to understanding reading disabilities, visual attention in autism, human-computer interface design, and countless other areas. The EyeLink protocol running on port 589 is part of that scientific apparatus.
But most of us will never knowingly encounter port 589 in legitimate use. We're more likely to see it in a security alert or a trojan port list.
That's the strange life of a specialized port.
Frequently Asked Questions About Port 589
Ήταν χρήσιμη αυτή η σελίδα;