Port 1696: rrifmm — A Name Without a Story

Port 1696 sits in the registered port range, carries an official IANA service name, and is otherwise a complete mystery.

What's Registered Here

IANA lists port 1696 as assigned to a service called rrifmm for both TCP and UDP. That's where the paper trail ends. There is no RFC defining rrifmm. No public documentation describing what it does. No software known to use it. No organization that has publicly claimed it.

The IANA port registry contains thousands of entries like this: names that were submitted at some point during the registration process, accepted, and then never developed into anything documented or widely deployed. Port 1696 is one of them.¹

What the Registered Range Means

Ports 1024 through 49151 are called registered ports — sometimes called "user ports." Unlike the well-known ports below 1024 (which require root/administrator privileges to bind on most systems), registered ports can be opened by ordinary user processes.

To claim a spot in this range, an organization or developer submits a request to IANA. IANA records the name and assignment. But IANA does not verify that a protocol is actually implemented, documented, or in use. The registry is a reservation system, not a certification. A name on the list means someone asked for it — nothing more.²

Known Unofficial Uses

None documented. Port 1696 does not appear in threat intelligence databases as a common malware port, and no widely used software is known to default to it. If you see traffic on this port, it's either something proprietary to your environment or worth investigating.

How to Check What's Listening

If port 1696 is open on a system you're responsible for, find out what's using it:

Linux / macOS:

# Show the process listening on port 1696
sudo ss -tlnp | grep 1696
# or
sudo lsof -i :1696

Windows:

netstat -ano | findstr :1696

Then take the process ID from the output and look it up:

# Linux/macOS
ps aux | grep <PID>

# Windows (in Task Manager, or:)
tasklist | findstr <PID>

If nothing comes back, the port isn't in use — which is the expected state for port 1696 on most systems.

Why Ghost Registrations Exist

The IANA registry is not a living directory of active protocols. It's a historical record. Ports get registered during development of products that never shipped, by companies that no longer exist, for internal protocols that were never published. Once registered, these names persist indefinitely.

Port 1696's "rrifmm" assignment is almost certainly one of these: a registration that predates modern documentation practices, from a time when IANA's process was less rigorous about requiring published specifications.

The honest answer to "what is port 1696?" is: officially registered, practically unknown.