Port 1127: supfiledbg — The Debugging Port That Outlived Its Protocol

Port 1127 sits in the registered port range (1024-49151), but it doesn't have an official IANA assignment. Instead, it has something more interesting: a history.

What Used Port 1127

Port 1127 was used by supfiledbg—a debugging service for SUP (Software Update Protocol). SUP was developed by Carnegie Mellon University in the 1980s to keep development trees synchronized across multiple Unix and BSD machines.¹²

Before Git, before rsync, before most of the tools we take for granted, there was SUP. It ran as a client program that talked over TCP to a file server, maintaining identical versions of files across different machines. CMU used it to distribute system binaries across alpha, beta, and default release levels.³

Port 1127 specifically handled debugging traffic for SUP—the diagnostic channel that let administrators figure out why synchronization was failing.

Why It's a Fossil

SUP is dead. It was replaced by CVSup (more bandwidth-efficient), which was replaced by other version control systems, which were largely replaced by Git and modern package managers.⁴

But port 1127 still shows up in old network configuration files, Unix system documentation, and port scanning databases. It's a fossil from the Cambrian explosion of network protocols—a time when people were still figuring out how to keep distributed systems synchronized.

The Registered Port Range

Port 1127 falls within the registered ports (1024-49151)—a range where IANA assigns port numbers to specific services upon request. These aren't as universally recognized as well-known ports (0-1023), but they're supposed to be consistent across systems.

The catch: supfiledbg was never officially registered with IANA. It was just widely used in BSD and NetBSD systems, which was enough for it to become semi-standard.⁵

This is how protocols worked in the early Internet—informal agreements between universities and research institutions, codified by usage rather than official registration.

What Happens to Abandoned Ports

When a port's service dies, the port doesn't disappear. It just becomes available again—technically. In practice, old port numbers linger in documentation, firewall rules, and configuration files for decades.

If you see port 1127 active on a modern system, it's either:

• A very old Unix/BSD installation still running legacy software
• Something else that chose to reuse the port number
• Malware that picked a registered but rarely-monitored port

Checking What's Listening

To see if anything is actually using port 1127 on your system:

Linux/macOS:

sudo lsof -i :1127
netstat -an | grep 1127

Windows:

netstat -ano | findstr :1127

If nothing returns, the port is closed—as it probably should be.

Why This Port Matters

Port 1127 is a reminder that the Internet's addressing system is an archaeological record. Every port number tells a story about what people needed to communicate, what problems they were solving, and what tools eventually replaced their solutions.

SUP solved the problem of keeping source code synchronized across universities in the 1980s. That same problem led to CVS, then Subversion, then Git. The port number is obsolete. The problem it addressed is still with us, just solved better.

Related Ports

• Port 871 — supfilesrv (the main SUP file server, also obsolete)
• Port 5999 — CVSup (SUP's successor, also now obsolete)
• Port 9418 — Git protocol (the modern descendant of the synchronization problem SUP was solving)