Port 1236: BindView UNIX Management — A ghost in the registry

What Port 1236 Was For

Port 1236 (TCP) was registered for Symantec BindView Control, a security and compliance management solution for UNIX systems. The port served as the communication channel between UNIX agents and a central management server, carrying security status updates, audit logs, and configuration data.¹

BindView Development Corporation created this software in the 1990s. Symantec acquired the company in January 2006 for $209 million.² Later, Symantec absorbed BindView into its Control Compliance Suite and eventually discontinued the product line. The software is gone. The port registration remains.

The Registered Port Range

Port 1236 sits in the registered ports range (1024-49151). Unlike well-known ports (0-1023), which are reserved for fundamental Internet protocols, registered ports are assigned by IANA to specific applications upon request. Any organization can apply to register a port for their software.

This range contains approximately 48,000 possible port numbers. Many are registered to software that no longer exists. Companies request a port number, build their product, register it with IANA, then the product is discontinued, acquired, or simply abandoned. The registration lives on in IANA's database—a fossil record of enterprise software.

Why This Matters

The registered port range tells a different story than the well-known ports. Well-known ports carry the Internet's fundamental protocols—SSH, HTTP, DNS. These are protocols that last decades. Registered ports carry what companies thought would be important. Most weren't.

Port 1236 is a reminder that software dies, but port registrations don't. Someone at BindView in the 1990s filled out IANA's application form. They specified TCP port 1236 for their UNIX management protocol. That decision is preserved in the registry, long after the last BindView server shut down.

If you find port 1236 open on a modern system, you're not looking at BindView—you're looking at either:

• Software coincidentally using an "available" registered port
• Malware that picked a quiet, forgotten port number
• A misidentification by a port scanner

The actual BindView software is gone. But the number remains, like a gravestone without a body beneath it.

How to Check What's Actually Listening

To see if anything is listening on port 1236 on your system:

Linux/macOS:

sudo lsof -i :1236
# or
sudo netstat -tulpn | grep 1236

Windows:

netstat -ano | findstr :1236

If you find something listening on this port, it's not BindView. That software doesn't exist anymore. It's something else—something that may or may not have a good reason to be there.