Port 404: The Ghost Service — Not Found in Practice

Port 404 sits in the well-known port range (0-1023), officially assigned to a service called "nced."¹ Nobody seems to know what nced does. The official IANA registry lists the name twice—once for the service, once for the description—and says nothing else.² No RFC. No documentation. No evidence anyone actually uses it.

The port exists. The assignment is real. But the service might as well be a 404 error itself.

The Cosmic Coincidence

Here's the genuinely strange part: port 404 shares its number with HTTP status code 404, the Internet's universal symbol for "Not Found."³ When you click a broken link and see "404 Not Found," that's not port 404—it's an HTTP response code, typically sent over port 80 (HTTP) or 443 (HTTPS).

But the coincidence is perfect. Port 404 is assigned to a service that's effectively not found. Web developers make jokes about being unable to locate "room 404" at conferences.⁴ The xkcd webcomic doesn't have a comic numbered 404—if you try to visit it, you get an actual 404 error, which is itself the joke.⁵

The number means absence. And port 404, despite being officially assigned, embodies exactly that.

What the Well-Known Range Means

Ports 0-1023 are called "well-known ports" or "system ports." IANA assigns them through a formal process called "IESG Approval" or "IETF Review."⁶ These are supposed to be the Internet's prime real estate—reserved for foundational protocols that everyone needs.

Port 22 is SSH. Port 25 is SMTP. Port 80 is HTTP. Port 443 is HTTPS.

And port 404 is... nced. Whatever that is.

The well-known range is where you put protocols that matter. Port 404's assignment to an apparently phantom service is like finding an abandoned storefront on the busiest street in town. The address is registered. Nobody's home.

What Might Be Listening

If you run a port scan on your own system and find port 404 open, it's worth investigating:

# Check what's listening on port 404
sudo lsof -i :404
# or
sudo netstat -tulpn | grep :404

It won't be nced (probably). It might be:

• A custom application someone configured to use port 404
• Malware trying to hide in an obscure port assignment
• A developer's inside joke (using port 404 for a service that reports errors)

The official assignment means nothing if nobody uses the official service.

Why This Port Matters

Port 404 is a reminder that the Internet's infrastructure includes ghosts—officially assigned numbers that never became real services. Someone, decades ago, registered "nced" for port 404. The registration stuck. The service didn't.

The well-known port range has 1,024 slots. Port 404 occupies one of them. And in a perfect coincidence, it shares its number with the error code that means something is missing.

The Internet has a sense of irony. Port 404 is the proof.

Checking Your System

To see if anything is actually using port 404 on your machine:

On Linux/Mac:

sudo lsof -i :404
sudo netstat -tulpn | grep :404

On Windows:

netstat -ano | findstr :404

If you find something listening, it's not the official service. It's something else that decided to use the number.