What This Port Was For
Port 1405 is officially registered with IANA1 for IBM Remote Execution Starter (ibm-res), available on both TCP and UDP. That's all we know with certainty.
The service itself—what it did, how it worked, when it was used—has disappeared. Modern IBM documentation doesn't reference it. There are no RFCs, no technical specifications, no deployment guides. IBM's current remote execution tools use different ports and different protocols entirely.
This is a ghost port. The registration exists, but the service it was registered for is gone.
The Registered Port Range
Port 1405 lives in the registered port range (1024-49151). This range contains ports that organizations can register with IANA for specific services. Unlike well-known ports (0-1023), these don't require special privileges to bind to. Unlike dynamic ports (49152-65535), these are supposed to be associated with specific services.
The registration means IBM claimed this port for a specific purpose. But claiming a port doesn't guarantee it gets used, stays used, or leaves any trace when it's abandoned.
The Security Shadow
What we do know about port 1405 comes from security databases, not service documentation. This port has been flagged2 as associated with trojan activity—malware that used this port to communicate, likely because it was registered but unused, making it less suspicious than a completely random port choice.
This doesn't mean port 1405 is inherently dangerous. It means malware authors noticed the same thing we did: a registered port with no active service is a convenient place to hide.
Checking What's Listening
If something is listening on port 1405 on your system, you should verify what it is:
Linux/macOS
Windows
If you find something listening and can't identify it as legitimate software you installed, investigate further.
Why Empty Ports Matter
Port 1405 represents something important about how the Internet's addressing system works. Ports don't disappear when services die. The registration remains. The number sits there, officially claimed but functionally abandoned.
This creates gaps in the registry—ports that are marked as "used" but aren't. These gaps can be exploited (as malware did with this port) or simply remain as historical artifacts, tombstones for services that once existed.
The IANA registry is full of these ghosts. Services that made sense in 1995 but don't exist in 2026. Corporate projects that were registered, deployed briefly, then discontinued. Protocols that were superseded by better alternatives.
Port 1405 is one of them. Officially assigned to IBM Remote Execution Starter. Historically abused by trojans. Currently used for nothing at all.
What "Remote Execution Starter" Might Have Been
We can make educated guesses. IBM has long history with remote execution systems—ways to run commands on distant machines. AIX (IBM's Unix) has remote command execution protocols.3 IBM i (formerly AS/400) has remote system execution APIs.4
"Remote Execution Starter" could have been a service that initiated these connections—a daemon that listened for requests to start remote execution sessions. But this is speculation. The service left no documentation trail.
Related Ports
Other IBM-related registered ports that actually see use:
- Port 449: AS Server Mapper (IBM i)
- Port 8470-8477: Various IBM services
- Port 9043: WebSphere HTTPS
These ports have documentation, active services, and clear purposes. Port 1405 doesn't.
The Honest Assessment
If you're here because:
- You saw this port in a scan: Probably nothing, but verify what's listening
- You need it for IBM software: You probably don't—modern IBM systems use different ports
- You're curious about the service: It's gone. The service is gone.
Port 1405 is a reminder that the Internet's addressing system carries history with it. Numbers get registered. Services disappear. The numbers remain, officially claimed but functionally empty, waiting for something that will never use them again.
Hasznos volt ez az oldal?