Port 985 sits in the well-known port range (0-1023) but has no official service assigned by IANA. Yet if you scan this port across networks, you'll find it's not exactly empty.
What Lives Here (Unofficially)
Two organizations have used port 985 for their own purposes without formal IANA assignment:
Apple's NetInfo (Historical)
Mac OS X and Mac OS X Server used port 985 for NetInfo, a hierarchical distributed database system that managed administrative data. NetInfo is deprecated now—Apple moved to Directory Services and eventually Open Directory—but older Mac systems still have port 985 associated with NetInfo's RPC-based services.12
NetApp's ARWD (Current)
NetApp ONTAP 9 uses TCP port 985 for ARWD (Anti-RansomWare Daemon), part of their Autonomous Ransomware Protection feature. The daemon analyzes workload patterns in NAS and SAN environments to detect potential ransomware attacks.34
Neither of these is an official IANA assignment. They're vendors who needed a port and claimed an unassigned one.
Why This Happens
The well-known port range (0-1023) is supposed to be reserved for services assigned by IANA. But hundreds of ports in this range remain unassigned. When a vendor needs a port for internal communication—especially for enterprise software that won't exist on public-facing servers—they sometimes just pick an unused number.
This works until it doesn't. If two vendors pick the same unassigned port, their software conflicts. If IANA later assigns that port officially, everyone who's been using it unofficially has a problem.
Port 985 got lucky. Apple's use is historical. NetApp's use is on specialized storage systems. They never collided.
What Range Port 985 Belongs To
Port 985 is in the well-known ports range (0-1023). Ports in this range are supposed to be assigned by IANA for standardized services that need reserved addresses. Most well-known ports are assigned—SSH gets 22, HTTPS gets 443, DNS gets 53.
But not all of them. Port 985 is one of several hundred well-known ports that remain unassigned.
How to Check What's Listening
On Linux or macOS:
On Windows:
If you see something listening on port 985, it's likely:
- An old Mac system running NetInfo
- A NetApp storage system running ARWD
- Something else entirely that claimed this port
There's no standard service, so you'll need to investigate what process owns it.
Why Unassigned Ports Matter
Unassigned ports are breathing room. They give IANA flexibility to assign new standardized services as the Internet evolves. They also serve as a commons—vendors can use them informally when they need internal protocols that won't conflict with public services.
But every unassigned port is also a potential conflict waiting to happen. Port 985 lucked out. Others haven't.
The Internet runs on standards, but it also runs on people making practical decisions—like using an unassigned port because you need one right now and 985 looks available.
このページは役に立ちましたか？