Port 1349: sbook — The ghost in the registry

Port 1349 sits in the registered ports range with an official assignment, but if you search for what actually uses it, you'll find almost nothing. It's registered to a service called sbook, described only as "Registration Network Protocol" in the IANA registry.¹ No documentation. No RFC. No active community. Just a name in a database.

This is more common than you'd think.

What the registry says

According to IANA (the Internet Assigned Numbers Authority), port 1349 is allocated for both TCP and UDP to a service named sbook.¹ The description—"Registration Network Protocol"—tells you almost nothing about what it actually does. Who registered it? When? For what purpose? The public record is silent.

Some third-party port databases mention MSN Messenger as using port 1349,² but MSN Messenger is long dead (it shut down in 2013), and there's no official documentation linking it to this port. Whether that usage was official, unofficial, or just misreported is unclear.

The registered ports range (1024-49151)

Port 1349 lives in the registered ports range—ports that can be formally requested from IANA for specific services.³ Unlike well-known ports (0-1023), which require root privileges and are tightly controlled, registered ports are available to anyone who fills out the application form.

This is where things get messy.

Companies and developers can register a port, assign it to a protocol, ship a product, and then—years later—abandon the project. The port remains registered. The protocol disappears. The documentation vanishes. All that's left is an entry in the IANA database pointing to something that no longer meaningfully exists.

Port 1349 appears to be one of these ghosts.

What this means for you

If you find port 1349 open on a system, it's worth investigating. Just because the official assignment is obscure doesn't mean something isn't using it. Ports can be repurposed unofficially. Malware sometimes squats on forgotten ports precisely because they're not well-monitored.⁴

To check what's listening on port 1349:

On Linux or macOS:

sudo lsof -i :1349

On Windows:

netstat -ano | findstr :1349

If something is using port 1349, the output will show you which process opened it and what it's doing. If nothing appears, the port is closed.

Why unassigned and obscure ports matter

The Internet runs on 65,535 possible ports per protocol (TCP and UDP). Only a fraction see regular use. The well-known ports (0-1023) are famous: HTTP on 80, HTTPS on 443, SSH on 22. But the registered range (1024-49151) is full of ports like 1349—officially claimed but practically invisible.

These ports matter because:

• They're still allocated. Even if sbook is gone, port 1349 remains registered to it. IANA doesn't reclaim ports easily.
• They can be repurposed unofficially. Applications sometimes use registered ports for entirely different purposes, creating confusion.
• They're security blind spots. Network monitoring tools focus on well-known ports. Obscure registered ports often slip through unnoticed.

Port 1349 is a reminder that the port numbering system isn't just a technical directory—it's a historical record. Every number tells a story, even when that story is "something was here once, but we don't remember what."