Port 1787: funk-license — A Ghost in the Registry

Port 1787 is registered to funk-license, a license management service for products made by Funk Software — a Cambridge, Massachusetts company that built some of the most widely used RADIUS authentication servers of the early 2000s, then sold to Juniper Networks in 2005 for $122 million.¹

You almost certainly don't have anything running on this port. But there's a quiet story in why it exists.

What Funk Software Built

Funk Software was founded in 1982. They became briefly famous in the late 1980s for a product called Sideways, which let people print wide spreadsheets sideways on dot matrix printers — a genuinely useful hack in an era before landscape printing was a standard option.

By the late 1990s, Funk had pivoted to network security. Their flagship product was Steel-Belted Radius: a commercial RADIUS/AAA server that enterprises used to authenticate users connecting to their networks — dial-up, VPN, wireless, wired 802.1X, all of it. At its peak, Steel-Belted Radius was running on thousands of networks worldwide.²

RADIUS authentication servers need license management. Funk registered port 1787 with IANA to handle that — the funk-license service, running on both TCP and UDP.

What Happened

Juniper Networks acquired Funk Software in November 2005. Steel-Belted Radius became a Juniper product. Most of Funk's ~140 employees transferred to Juniper, and the Cambridge offices stayed open, but Funk Software as an independent entity ceased to exist.³

Juniper continued selling Steel-Belted Radius Carrier Edition for years afterward. But the original brand, the original company, the engineers who registered port 1787 with names "Cimarron Boozer" and "Eric Wilde" at funk.com — all of that is long gone.

Port 1787 remains in the IANA registry, unchanged, as it will remain forever. IANA doesn't reclaim port numbers.

Is Anything Actually Using This Port?

Probably not, unless you're running legacy Funk Software or Juniper Steel-Belted Radius infrastructure. If you see traffic on port 1787 on a modern network and you're not running SBR, that warrants investigation.

To check what's listening on port 1787 on your system:

macOS / Linux:

# Check if anything is listening on port 1787
ss -tlnp | grep 1787
# or
lsof -i :1787

Windows:

netstat -ano | findstr :1787

If nothing appears, nothing is using it — which is the expected result on virtually any modern system.

The Registered Port Range

Port 1787 sits in the registered ports range (1024–49151). Unlike the well-known ports below 1024 (which require root/administrator privileges to bind), registered ports can be used by any process. IANA maintains a registry of assignments in this range to prevent collisions — when a company wants to use a specific port for their software, they register it, and IANA marks it as taken.

The system works reasonably well for widely-used services. For ports like 1787, it mostly produces a permanent record of companies and products that came and went.