Port 1345: VPJP — The Mystery Acronym

Port 1345 sits in the registered ports range (1024-49151) with an official assignment from IANA: VPJP. Both TCP and UDP protocols can use this port. But here's the strange part—nobody seems to know what VPJP actually means.

The Official Assignment

According to IANA's Service Name and Transport Protocol Port Number Registry, port 1345 is registered to a service called VPJP.¹ The registration exists. The acronym appears in port databases everywhere. But the full name behind those four letters? Missing.

This isn't a forgotten protocol from the 1970s. This is a registered port with an acronym that apparently never got explained.

The Historical Confusion

In November 2000, network administrators on security mailing lists encountered traffic on port 1345 and tried to figure out what VPJP was. They found the same thing we find today: the acronym, but no explanation.²

One administrator detected UDP traffic to multicast addresses on port 1345 from multiple stations inside their network. They asked what VPJP meant. The responses focused on the multicast nature of the traffic—not on identifying VPJP itself. Because nobody knew.

The Symantec Ghost Connection

Some port databases list port 1345 as associated with "ghost-server"—part of Symantec Ghost's multicast imaging system.³ Symantec Ghost allows administrators to deploy disk images to multiple computers simultaneously over the network.

But Symantec's own documentation shows Ghost multicast uses dynamically assigned ports, not port 1345 specifically.⁴ The association exists in some databases, but the official Symantec documentation doesn't mention port 1345.

What This Port Actually Is

Here's what we know for certain:

• Official service name: VPJP (TCP and UDP)
• Port range: Registered (1024-49151)
• What VPJP stands for: Unknown
• Current common use: Possibly related to multicast traffic, but unconfirmed
• Security concerns: Some historical reports of unexplained traffic on this port⁵

The port exists in the registry. Traffic has been observed on it. But what VPJP actually means remains a mystery even 25 years after network administrators first asked the question.

How to Check What's Using Port 1345

If you want to see what's actually listening on port 1345 on your system, you can use these commands:

On Linux:

# Using ss (modern)
sudo ss -tulpn | grep 1345

# Using netstat (older systems)
sudo netstat -tulpn | grep 1345

# Using lsof (to see the process)
sudo lsof -i :1345

On macOS:

sudo lsof -i :1345

On Windows:

netstat -ano | findstr :1345

These commands show whether anything is actively listening on or communicating through port 1345, and which process is responsible.⁶

Why Unassigned Ports Matter

Port 1345 technically isn't unassigned—it has a registered service name. But it might as well be unassigned, because the service name explains nothing.

The registered ports range (1024-49151) exists so organizations can register ports for their services without conflicts. IANA maintains this registry to prevent two different services from claiming the same port number.

But registration only works if people know what the registered names mean. VPJP is registered, but the registration is functionally useless because nobody can identify what VPJP is.

This is rare. Most registered ports either have clear service names (like "https" on 443) or at least have documentation explaining the acronym. Port 1345 has neither.

The Bureaucratic Ghost

There's something almost philosophical about port 1345. It exists in every official port registry. Security tools recognize it. Network administrators have been asking about it for decades. But what is it?

VPJP appears in IANA's database. It appears in security incident reports from 2000. It appears in modern port scanning tools. But the meaning behind the acronym—the actual service it was supposed to represent—seems to have vanished, if it ever existed at all.

The port is a bureaucratic ghost: officially present, but hollow. A name without a referent. An acronym that points to nothing.