Port 394: EMBL Nucleic Data Transfer — The Ghost of Early Bioinformatics

Port 394 is assigned to the EMBL Nucleic Data Transfer (embl-ndt) protocol for both TCP and UDP.¹ It represents a specific moment in scientific computing history: the early 1990s, when researchers were building the first infrastructure to share genetic sequence data across the Internet.

What EMBL-NDT Was

The European Molecular Biology Laboratory (EMBL) maintains one of the world's primary nucleotide sequence databases—a catalog of DNA and RNA sequences submitted by researchers worldwide. In the early 1990s, getting this data to research institutions across Europe required custom protocols.

EMBL-NDT was developed by EMBnet (the European Molecular Biology network) as part of their mission to distribute bioinformatics databases and computational resources. The protocol handled automated database distribution, synchronizing copies of sequence data between EMBL's central repository and national nodes across Europe.²

The contact listed in RFC 1700 for this port assignment was Peter Gad at Uppsala University in Sweden (peter@bmc.uu.se).³ This reflects the distributed nature of the project—not centrally controlled by EMBL, but coordinated across European research institutions.

The Historical Context

In 1991, EMBnet received its first European grant and began building infrastructure for automated database distribution.² By 1996, EMBnet had 26 nodes across Europe. Each node needed synchronized copies of:

• EMBL's nucleotide sequence database (Europe)
• NCBI's GenBank (United States)
• DDBJ's database (Japan)

The NDT protocol was EMBnet's solution for this synchronization. Before HTTP became ubiquitous, before rsync was widely adopted, custom protocols like EMBL-NDT solved specific distribution problems.

What Replaced It

Modern EMBL data distribution uses standard protocols. The EMBL-EBI (European Bioinformatics Institute) now provides:

• HTTP/HTTPS downloads
• FTP access
• Aspera's FASP high-speed transfer protocol for large datasets⁴

Port 394 remains assigned to embl-ndt in the IANA registry, but the protocol is effectively obsolete. The port exists in the registry as historical record—proof that this specific solution once mattered enough to warrant an official port assignment.

Why This Port Matters

Port 394 represents a category of ports assigned to protocols that solved real problems but didn't last. Scientific computing in the 1990s was full of these custom solutions. Labs built what they needed with the tools available at the time.

The EMBL sequence database that EMBL-NDT was built to distribute is still essential infrastructure. Researchers still use it every day. But the protocol that once synchronized it across Europe is gone, replaced by standards that emerged later.

Security Considerations

Some security scanning tools flag port 394 as potentially associated with trojans or malware,⁵ but this appears to be based on general suspicion of uncommon ports rather than documented malware using this specific assignment. Since the legitimate protocol is obsolete, any traffic on port 394 warrants investigation.

Checking Port 394

To see if anything is listening on port 394:

# Linux/Mac
sudo lsof -i :394
sudo netstat -tlnp | grep :394

# Windows
netstat -ano | findstr :394

You shouldn't see anything. If you do, investigate what's using it.

Related Ports

• Port 43: WHOIS protocol for querying domain/IP databases
• Port 70: Gopher protocol (another obsolete early Internet protocol)
• Ports 389/636: LDAP/LDAPS for directory services
• Port 873: rsync, which became the standard for efficient file synchronization