Port 1204: Accord-MGC and ssslog-mgr — Two Services, One Number

Port 1204 demonstrates something fundamental about how the Internet's port system works: TCP and UDP maintain completely separate registries. The same port number can—and does—serve entirely different purposes depending on which protocol is being used.

What Runs on Port 1204

TCP Port 1204: Accord-MGC
Accord-MGC (Media Gateway Controller) is a registered service for controlling media gateways in telecommunications networks. An MGC acts as the brain in VoIP architectures, managing multiple media gateways that convert between traditional telephone networks (PSTN) and modern IP-based voice systems.¹²

UDP Port 1204: ssslog-mgr
The ssslog-mgr service operates as a Log Request Listener, handling logging infrastructure requests. This service is part of log management systems that collect, process, and store system logs across distributed networks.³

Two Protocols, Two Worlds

These services never collide because TCP and UDP are fundamentally separate transport protocols:

• TCP traffic on port 1204 goes to Accord-MGC for telecommunications control
• UDP traffic on port 1204 goes to ssslog-mgr for logging requests

Your operating system's network stack keeps them completely separate. A program listening on TCP port 1204 won't see UDP packets, and vice versa. They share the number but live in different channels.

How Accord-MGC Works

Media Gateway Controllers sit at the center of modern telephone systems. When you make a call that crosses from a traditional phone network to VoIP (or back), an MGC coordinates the connection:

1. The MGC receives signaling about the call
2. It instructs media gateways to establish the audio path
3. It manages the connection throughout the call
4. It handles teardown when the call ends

The MGC uses control protocols (often MGCP or H.248) to tell media gateways what to do. The actual voice traffic flows through the gateways, but the MGC makes all the decisions.⁴

How Log Request Listeners Work

The ssslog-mgr service handles centralized logging—collecting log messages from multiple systems into a single location for monitoring, analysis, and troubleshooting.

Systems across a network send their log messages to the listener on UDP port 1204. UDP makes sense here because:

• Logs are typically fire-and-forget messages
• Losing an occasional log entry is acceptable
• The overhead of TCP connections would be wasteful for short messages
• High-volume logging benefits from UDP's lower latency

The Registered Port Range

Port 1204 falls within the registered port range (1024-49151). These ports are registered with IANA for specific services, but the registration is softer than the well-known ports below 1024.⁵

Anyone can request to register a port for their service. IANA tracks these assignments to prevent conflicts, but unlike well-known ports, there's no requirement that operating systems restrict access to registered ports.

Security Considerations

For Accord-MGC (TCP 1204):
Media gateway controllers handle critical telecommunications infrastructure. Exposing MGC services to the public Internet creates risk:

• Unauthorized control of media gateways
• Potential eavesdropping on call setup
• Denial of service against telephony infrastructure

MGC should only be accessible within trusted networks, typically protected by firewalls and VPNs.

For ssslog-mgr (UDP 1204):
Log listeners accept messages from across the network. Risks include:

• Log injection attacks (malicious log entries)
• Information disclosure if logs contain sensitive data
• Resource exhaustion from log flooding
• Spoofed log entries that obscure actual security events

Restrict log listeners to known source addresses and implement authentication where possible.

Checking What's Listening

To see if anything is listening on port 1204 on your system:

Linux/macOS:

# Check both TCP and UDP
sudo lsof -i :1204
sudo netstat -an | grep 1204

Windows:

netstat -ano | findstr :1204

The output will show which protocol (TCP or UDP) is in use and which process is listening.

Why This Port Matters

Port 1204 isn't famous. You won't find it on cheat sheets of "common ports to know." But it demonstrates something important about how the Internet's addressing system works:

Protocols are separate namespaces. TCP port 1204 and UDP port 1204 are as different as two houses with the same street number in different cities. The protocol is part of the address.

Registration reduces chaos. Both services registered their use of port 1204 with IANA. Without that registry, vendors might choose the same ports and create conflicts.

Purpose varies wildly. Telecommunications control and log management have nothing in common except a shared number on different protocols. The port number itself carries no inherent meaning—it's just an agreed-upon meeting point.