Port 1049: td-postman — When Legitimate Services and Malware Share an Address

Port 1049 sits in the registered port range (1024-49151), officially assigned to a legitimate service but later exploited by malware. This created a complicated reputation: security databases flag it as dangerous, while IANA lists it as a registered business application.

What Port 1049 Was Registered For

The Internet Assigned Numbers Authority (IANA) officially assigned port 1049 to td-postman (Tobit David Postman VPMN) for both TCP and UDP.¹

Tobit David is a European groupware and business communication system developed by Tobit Software in Germany. Since 1997, David has served as a comprehensive platform combining email, fax, telephony, and messaging for companies—primarily in Europe.² The "Postman" component handles message delivery within this ecosystem.

VPMN likely stands for "Virtual Private Messaging Network," though Tobit's documentation from that era is sparse in English-language sources.

The Malware Problem

Here's where port 1049's story gets complicated: various trojan horse and backdoor programs later used this same port number for malicious communications.³

Security resources from the early 2000s flagged port 1049 as a "dangerous TCP/IP port" that should be monitored with firewall alarms.⁴ This doesn't mean the legitimate Tobit service was malicious—it means malware authors chose to use the same port number, either to blend in with legitimate traffic or simply because the port was available.

This is a fundamental truth about port numbers: they're just addresses. Whether traffic on port 1049 is legitimate business messaging or a trojan depends entirely on what software is listening.

Why This Dual Reputation Matters

If you see port 1049 open on a system, it could be:

1. Legitimate Tobit David installation — Common in European businesses using this groupware system
2. Leftover malware — Older trojans that used this port (less common today)
3. Custom application — Any software can listen on registered ports
4. Nothing — The port might be closed entirely

The lesson: port numbers alone don't tell you whether traffic is safe or dangerous. Context matters.

The Registered Port Range

Port 1049 falls in the registered port range (1024-49151). These ports are:

• Registered with IANA for specific services, but not reserved
• Available for other uses — applications can use them even if they're registered to something else
• Not privileged — any user process can bind to them (unlike well-known ports 0-1023)

This flexibility is why the same port can host both legitimate services and malware at different times, on different systems.

How to Check What's Using Port 1049

On Linux or macOS:

sudo lsof -i :1049
# or
sudo netstat -tulpn | grep 1049

On Windows:

netstat -ano | findstr :1049

This shows you which process (if any) is listening on port 1049. From there, you can determine whether it's Tobit David, something suspicious, or nothing at all.

Why Unassigned and Registered Ports Matter

The Internet has 65,535 ports. Only 1,024 are reserved as "well-known." The remaining 64,511 ports need to exist for:

• Registered services like Tobit David that need consistent port numbers
• Dynamic allocation where your OS assigns random ports for outbound connections
• Custom applications that need to listen somewhere

Port 1049's story—a legitimate service later exploited by malware—illustrates why this flexibility matters and why port numbers alone never tell the whole story.

The port is just a door. What matters is what's behind it.