Port 571: Udemon — The ghost in the well-known range

Port 571 sits in the well-known range—ports 0-1023, the numbers IANA reserves for important system services. HTTP gets 80. HTTPS gets 443. SSH gets 22. And udemon gets 571.

Except nobody uses udemon anymore. Nobody remembers what it did. The port assignment remains, a ghost in the registry.

What Udemon Was

According to IANA's official registry, port 571 is assigned to "udemon"—listed as a "meter" service.¹ Both TCP and UDP variants exist. But search the Internet for what udemon actually did, and you'll find almost nothing. No RFC. No documentation. No community of users mourning its loss.

The name suggests "Unix daemon"—probably a monitoring or metering service from the early days of networked Unix systems. Something that measured resource usage, perhaps. Something that ran in the background and reported metrics.

But it's gone now. The port remains assigned, but the service has vanished.

The Well-Known Range

Ports 0-1023 are special. They're the "well-known ports," assigned by IANA to system services important enough to claim a permanent spot in the registry. Getting a well-known port means your service matters. It means you're part of the infrastructure.

Port 571 has that status. Which means at some point, udemon mattered. Someone built it. Someone used it. Someone thought it was important enough to claim a well-known port number.

And then it disappeared.

What's Actually Running Here

On modern systems, port 571 is almost certainly closed. You can check with:

# See if anything is listening
sudo lsof -i :571
sudo netstat -tuln | grep :571

# Or scan it
nmap -p 571 localhost

You'll probably find nothing. The port is assigned but unused—reserved for a service that no longer exists.

Why This Matters

The Internet is built on layers. Every protocol we use today sits on top of protocols that came before. Every service depends on infrastructure that someone built decades ago.

Port 571 is a reminder that some of those layers have disappeared. Services that once mattered enough to claim well-known ports have vanished, leaving only registry entries behind. The Internet doesn't just grow—it also forgets.

Udemon is gone. But its port number remains, a monument to something that once ran on Unix systems across the early Internet. We don't know exactly what it did. We don't know who built it or when it stopped being used.

We just know it was important enough to get port 571. And now it's not.

Security Note

Because port 571 is assigned but rarely used, some sources have flagged it as potentially associated with malware or trojans.² This doesn't mean the original udemon service was malicious—just that abandoned well-known ports sometimes get repurposed by attackers precisely because they're unexpected.

If you see traffic on port 571, investigate it. It's probably not legitimate udemon traffic, because udemon doesn't exist anymore.

The Registry Remembers

IANA's service registry is a kind of memory—a record of every service that ever claimed a port number. Most of those services still exist. HTTP still uses port 80. DNS still uses port 53.

But some, like udemon, are just ghosts. Port numbers assigned to services that nobody uses, nobody remembers, and nobody mourns.

Port 571 is one of those. A well-known port for an unknown service. A reminder that even the Internet's infrastructure has a graveyard.