Port 1870: SunSCALAR DNS — A Ghost in the Registry

What Port 1870 Is

Port 1870 is officially registered with IANA for SunSCALAR DNS Service, a DNS component of Sun Microsystems' SunSCALAR server clustering platform. It operates on both TCP and UDP.

Sun Microsystems was acquired by Oracle in 2010. SunSCALAR as a product line faded away in the years prior. The port remains in the registry, but there is no meaningful active deployment of the service it was registered for.

In practice, if you see traffic on port 1870, it is almost certainly not SunSCALAR DNS. It is something else entirely — a custom application, a game server, internal tooling, or something you should probably investigate.

The Registered Port Range

Port 1870 falls in the registered ports range (1024–49151), also called "user ports" in IANA's current terminology.¹

Here is what that range means:

• Well-known ports (0–1023): Reserved for system services. Require root/administrator privileges to bind. SSH is 22, HTTP is 80, HTTPS is 443.
• Registered ports (1024–49151): Available for registration by vendors and application developers. No special privileges required to bind. IANA maintains a registry, but enforcement is limited to the honor system.
• Dynamic/ephemeral ports (49152–65535): Handed out automatically by the OS for outbound connections. Never permanently assigned.

The registered range is enormous — over 48,000 ports — and the registry is crowded with relics. Products come and go. The ports they claimed stay registered indefinitely. IANA has no mechanism to reclaim them.

Ghost Ports

Port 1870 represents a common phenomenon: a port registered in good faith by a real company for a real product, now stranded in the registry after the product's death.

This happens constantly. Enterprise software products from the 1990s and 2000s registered ports for clustering, management, licensing, and service-discovery protocols that have since been replaced, deprecated, or folded into other products. The ports remain. The software does not.

If you are designing an application and considering port 1870, IANA technically lists it as taken. In practice, you are unlikely to conflict with anything. But the cleaner move is to pick a port in the dynamic range or find a genuinely unassigned registered port for your use.

How to Check What Is Actually Listening

If you see port 1870 open on a system you manage, here is how to identify what is using it:

Linux / macOS:

# Show the process listening on port 1870
sudo ss -tlnp sport = :1870

# Or with lsof
sudo lsof -i :1870

Windows:

# Show listening port and associated process ID
netstat -ano | findstr :1870

# Then look up the process
tasklist | findstr <PID>

Neither command will return SunSCALAR. If something is listening, it is a local application that chose this port for its own reasons.