Port 981: Unassigned — The Unofficial Firewall Door

What Port 981 Is (and Isn't)

Port 981 belongs to the well-known port range (0-1023), the block of port numbers that IANA—the Internet Assigned Numbers Authority—reserves for standardized services. These are the ports that everyone's supposed to know about. SSH lives at 22. HTTPS at 443. DNS at 53.

Port 981? IANA left it blank. No official assignment. No RFC defining what should run here. Just an empty slot in the registry.

But empty doesn't mean unused.

The Unofficial Tenant

In practice, port 981 has a job: remote HTTPS management for Check Point firewall devices running embedded VPN-1 software.¹

This isn't official. Check Point didn't file papers with IANA. They needed a port for secure remote administration of their firewalls, picked 981, and started using it. Over time, it became an informal standard in the security infrastructure world.

If you're a network administrator and you see traffic on port 981, there's a good chance it's someone managing a Check Point firewall. But technically? Anyone could use this port for anything. There's no official claim to it.

What "Unassigned" Actually Means

When IANA marks a well-known port as unassigned, it means:

• No official protocol owns it — No RFC defines what should run here
• No standardized service — Applications shouldn't assume port 981 means anything specific
• Available for allocation — IANA could assign it officially at any time if someone applies
• Fair game for custom use — Organizations can use it for internal services without violating standards

The well-known range exists to prevent chaos—to make sure that when you connect to port 80, you get HTTP, not someone's random file transfer protocol. But not every number from 0 to 1023 has an official purpose. Some remain in reserve. Some, like 981, get borrowed unofficially.

Why This Matters

The gap between official assignments and actual usage reveals something true about how the Internet works.

The IANA registry is the map. But the territory—the real Internet, with millions of networks and billions of devices—doesn't always wait for official approval. When Check Point needed a port for firewall management, they didn't submit an RFC and wait for IANA to deliberate. They picked an empty number and went to work.

This creates a practical problem: port collisions. If two vendors both decide to use the same unassigned port for different purposes, networks running both services have a conflict. One has to change. That's why official assignments exist—to prevent exactly this kind of collision.

But it also creates an informal registry, a collective understanding that emerges from practice. Port 981 means Check Point to enough people that using it for something else would be confusing, even though there's no official rule against it.

How to Check What's Listening on Port 981

If you want to see whether something is actually using port 981 on your system:

On Linux or macOS:

sudo lsof -i :981

On Windows (PowerShell):

Get-NetTCPConnection -LocalPort 981

Using netstat (any system):

netstat -an | grep 981

If you see output, something's listening. If it's a Check Point firewall management interface, that's expected. If it's something else, that's the informal Internet at work.

The Bigger Picture

Port 981 sits in a strange category: officially nothing, unofficially something. It's a reminder that the Internet is both a designed system with registries and standards, and an organic network where people solve problems first and standardize later—if ever.

The well-known port range was supposed to be fully mapped, every number accounted for. But reality is messier. Some ports never found their official purpose. Some found unofficial ones instead.

Port 981 is one of the doors that doesn't appear on the blueprint but exists in the building anyway.