Port 1671: netview-aix-11 — A Legacy IBM Reservation

What Port 1671 Is

Port 1671 sits in the registered ports range (1024-49151). These are ports that organizations can formally request from IANA for specific services — they aren't freely grabbed like dynamic ports, but they also don't carry the guaranteed universality of well-known ports below 1024.

Port 1671 has a registration: netview-aix-11.

That name is worth unpacking.

NetView on AIX

IBM's NetView/6000 was a network management platform built for AIX, IBM's flavor of Unix. It let administrators monitor and manage networked systems from a central console — collecting diagnostics, tracking performance, and managing IBM's SNA (Systems Network Architecture) environments.

When IBM registered ports for NetView, they didn't ask for one. They asked for twelve. Ports 1661 through 1672 were assigned to netview-aix-1 through netview-aix-12, each corresponding to a different NetView management instance or communication channel. Port 1671 is instance eleven of twelve. ¹

This was the 1990s. Big iron. Centralized management. IBM ruled enterprise networking, and NetView was how you watched it all.

Today, AIX is still in use in some enterprise environments, but NetView/6000 is a relic. The port registration remains — IANA registrations don't expire — but the service behind it is largely gone. On the vast majority of networks, port 1671 sits silent.

What You'll Actually Find on Port 1671

If you see traffic on port 1671 today, it's almost certainly not NetView. The realistic possibilities:

• Application-specific use: Some software picks ports from the registered range when its intended ports are occupied, or simply because no strict protocol governs what runs on registered ports.
• Malware or scanning activity: Port scanners touch everything. Unusual traffic on obscure registered ports is worth investigating.
• Nothing: The most common answer.

How to Check What's Listening

On Linux or macOS:

# Show all listening ports with process info
ss -tlnp | grep 1671

# Or with lsof
lsof -i :1671

On Windows:

netstat -ano | findstr :1671

If something appears, the process ID (PID) will tell you what's actually running there. On Linux, cross-reference with:

ps aux | grep <PID>

Why Unassigned and Legacy Ports Matter

The registered port range contains thousands of entries like this one — historical claims on port numbers for services that have faded, been replaced, or simply never saw wide adoption. They're not dangerous by themselves. But they matter for two reasons.

First, they're not truly free. Running a service on port 1671 won't break anything, but you're technically squatting on IBM's reservation. In practice, nobody cares. In principle, it's worth knowing.

Second, unexpected traffic is a signal. A port that should be quiet but isn't is worth a second look. The value of knowing a port's registered purpose — even an obscure one from 1993 — is that it gives you a baseline. Deviation from baseline is how you find problems.

Port 1671 should be quiet. If it isn't on your network, ask why.