Port 1115: ARDUS Transfer — The ghost protocol

Port 1115 exists in a strange space—officially registered with IANA, but functionally unknown. It's assigned to something called ARDUS Transfer (ardus-trns), and that's where the trail goes cold.

What Is ARDUS Transfer?

ARDUS stands for Automatic Retrieval Delete Update System.¹ That's the extent of what's documented. The protocol was registered in the early days of IANA's port assignments, claiming ports 1115, 1116, and 1117. A contact named Shinya Abe is listed in the registry.

And then... nothing. No RFC. No implementation guide. No software that anyone remembers using. The protocol appears to have used UDP more than TCP, but even that's uncertain.²

It's a ghost in the registry—a port number without a protocol anyone can find.

The Registered Ports Range

Port 1115 lives in the registered ports range (1024-49151). This range is managed by IANA, and organizations can request specific port numbers for their services. Unlike well-known ports (0-1023), these don't require root privileges to bind to on most systems.

The registry contains thousands of ports like 1115—officially assigned to services that may or may not still exist, may or may not ever have been widely deployed, may or may not still be running somewhere on a forgotten server.

Security Concerns

Here's where it gets interesting. When a port is registered but unused, it becomes attractive to malware. Port 1115 has been associated with several Remote Access Trojans (RATs) including TransScout and Lurker.³ These are unofficial uses—malware hijacking an abandoned port number.

If you see unexpected traffic on port 1115, it's worth investigating. The legitimate ARDUS protocol is so rare that any activity is more likely to be suspicious than authentic.

Checking What's Listening

To see if anything is listening on port 1115 on your system:

Linux/macOS:

sudo lsof -i :1115
netstat -an | grep 1115

Windows:

netstat -an | findstr 1115

If something is listening and you don't know what it is, that's a red flag.

Why This Port Matters

Port 1115 represents something important about the Internet's infrastructure: not everything survives. Protocols are proposed, ports are registered, software is written—and sometimes it all just fades away. The port number remains in the registry like a gravestone marking where something once intended to exist.

The IANA port registry is a historical document as much as a technical one. It shows not just what the Internet is, but what it tried to be. Port 1115 is a reminder that for every HTTP and SSH that becomes essential infrastructure, there are dozens of protocols that never found their purpose.

ARDUS Transfer is out there somewhere in the registry, waiting. Maybe someone still runs it. Maybe it was never actually deployed. Maybe it solved a problem that stopped mattering. We'll probably never know.