Port 1059: Nimreg — Where AIX Clients Call Home

What Runs Here

Port 1059 carries nimreg (NIM registration) traffic for IBM's AIX Network Installation Manager (NIM). Both TCP and UDP protocols use this port.

When an AIX client machine boots up without an operating system—or needs updates—it connects to the NIM master server on port 1059 to register itself and request provisioning.¹ This is the port where machines introduce themselves and say "I need an operating system."

The companion port is 1058 (nim), which handles the actual installation instructions and file transfers. Port 1059 specifically handles registration and status reporting.

How NIM Works

IBM's Network Installation Manager solved a real problem in the 1990s: how do you install and maintain Unix across hundreds of enterprise machines without physically touching each one?

The answer: clients boot over the network using BOOTP and TFTP, then connect to a NIM master server on ports 1058 and 1059.² The master server provisions them with operating system images, updates, and configuration.

The registration flow:

1. Client boots and discovers the NIM master via network protocols
2. Client connects to port 1059 (nimreg) to register and report status
3. Client receives provisioning instructions via port 1058 (nim)
4. Operating system installation proceeds over the network

This is automation at the hardware level—machines provisioning themselves without human intervention.

The AIX Context

AIX (Advanced Interactive eXecutive) is IBM's Unix variant for Power Systems servers.³ First released in 1986, AIX became the foundation for enterprise computing at banks, airlines, and large corporations throughout the 1990s and 2000s.

NIM was IBM's answer to large-scale AIX deployment. Instead of installing each server individually, system administrators could configure a NIM master once and let client machines provision themselves on boot.

Port 1059 is the registration checkpoint in this process—where clients check in and establish their identity before receiving an operating system.

Registered Port Range

Port 1059 lives in the registered ports range (1024-49151). These ports are assigned by IANA to specific services upon application by organizations.⁴

IBM registered port 1059 for nimreg specifically for AIX's network installation infrastructure. If you're not running AIX NIM, this port should be unused on your systems.

Security Considerations

Legitimate use: Only found in AIX environments with Network Installation Manager configured.

Past malware: Some security databases flag port 1059 because trojans have occasionally used unassigned registered ports for command-and-control traffic.⁵ However, this doesn't mean the port itself is dangerous—it means unassigned or unused ports can be exploited by malware.

What to check: If you see port 1059 open on a system that isn't an AIX NIM master, investigate. It could be:

• Leftover configuration from a decommissioned AIX environment
• Another application unofficially using this port
• Potentially malicious software

How to check what's listening:

# Linux/Unix
sudo lsof -i :1059
sudo netstat -tulpn | grep 1059

# Windows
netstat -ano | findstr :1059

On an AIX NIM master, you should see the nimesis daemon listening on this port.

Related Ports

• Port 1058 (nim) — The companion port for actual NIM installation operations
• Port 69 (TFTP) — Used for initial boot file transfers in NIM environments
• Port 111 (portmapper/rpcbind) — Often used alongside NIM for RPC operations

Why This Port Matters

Port 1059 represents a specific philosophy in enterprise computing: automation at scale. Every client that boots and finds this port open knows exactly what to do—register, identify, receive instructions.

It's the kind of infrastructure that becomes invisible when it works. Hundreds of servers can provision themselves overnight without a single administrator logging in manually.

That's the promise this port carries: machines managing machines, systems configuring systems, automation reducing the need for hands-on intervention in the data center.