Port 599 occupies a strange position in the Internet's nervous system. It's officially assigned to something called the "Aeolon Core Protocol" (ACP) in the IANA registry1, but the protocol itself appears to have never existed in any meaningful way.
What Is Port 599?
Port 599 is a system port (part of the 0-1023 range reserved for well-known services) assigned to the service name "acp" for both TCP and UDP protocols. System ports are supposed to be the VIPs of the port world—reserved by IANA for important, standardized protocols that the Internet depends on.
But port 599 breaks that pattern. It has the reservation, but not the protocol.
The Mystery of Aeolon Core Protocol
Every port in the system ports range should have a story. Port 22 has SSH. Port 80 has HTTP. Port 443 has HTTPS. These are protocols with RFCs, documentation, implementations, and millions of active connections.
Port 599 has a name: Aeolon Core Protocol. But that's where the trail ends.
There's no RFC defining it. No technical documentation describing how it works. No company or organization claiming to have created it. Searching for "Aeolon Core Protocol" returns only port lookup databases that parrot the IANA assignment—no source material, no history, no purpose.
There is an Aeolon Technology Co., Ltd.2, but they manufacture wind turbine blades, not network protocols. The name appears to be coincidental.
The protocol exists as a ghost—present in the registry but absent from reality.
What Actually Uses Port 599
In practice, port 599 is mostly empty. But empty space gets squatted.
Security databases have flagged port 599 as a port that malware has used for communication3. This doesn't mean the port itself is dangerous—it means that trojans and viruses have historically borrowed the unused address to establish command-and-control channels or exfiltrate data.
This is common with obscure or unused ports. Malware authors prefer ports that aren't monitored, aren't expected to carry traffic, and won't trigger automatic alerts. Port 599 fits the profile.
Why Unassigned Ports Matter
Port 599 demonstrates something important about how the Internet's address space works: assignments don't guarantee use.
The IANA registry is a reservation system, not a deployment tracker. Someone, at some point, requested port 599 for the Aeolon Core Protocol. IANA granted it. But requesting a port doesn't mean you'll ever use it, and IANA doesn't revoke assignments just because a protocol was never implemented.
The result is a registry full of ghost ports—officially assigned, technically reserved, practically vacant.
These empty ports matter for security. An open port 599 on your system isn't running the Aeolon Core Protocol (because that doesn't exist). It's running something else. Maybe a legitimate custom service. Maybe malware. The lack of a standard makes investigation harder.
How to Check What's Listening on Port 599
If you want to see if anything is using port 599 on your system:
On Linux or macOS:
On Windows:
If something is listening, investigate what process owns it. If you didn't intentionally run a service on port 599, you should find out what did.
The Bigger Picture
Port 599 is a reminder that the Internet's infrastructure includes not just what exists, but what was intended to exist and never materialized. Every port number is a potential story. Some become essential protocols serving billions of requests per day. Others become placeholders that no one ever filled.
Port 599 got a name, a number, and a place in the registry. It just never got a purpose.
Frequently Asked Questions About Port 599
Ήταν χρήσιμη αυτή η σελίδα;