Port 1000 — The Unassigned Well-Known Port

What Port 1000 Is

Port 1000 is officially unassigned by IANA. It sits in the well-known port range (0–1023), which means IANA controls it, but no single service has claimed it. This makes it unusual—not because it's empty, but because it's ambiguous.

The Range It Belongs To

Well-known ports (0–1023) are IANA's most carefully curated territory. These are the ports where SSH, SMTP, DNS, HTTP, and HTTPS live. They're assigned by formal request and documented in RFCs. Port 1000 was never assigned. This creates a gap: it's too important to be truly ephemeral, but too unclaimed to be trusted.

What Actually Uses It

In practice, port 1000 is used by:

• FortiGate firewalls — Use it for "policy override keepalive," a heartbeat signal between clustered firewall nodes [^1]
• Java RMI — Remote Method Invocation registry sometimes binds here [^2]
• VMware — Virtual Console Proxy services [^2]

None of these are the official designation. They're implementations that chose an open port and it stuck.

The Malware Problem

Port 1000 is a popular target for exploitation. Known trojans and malware families that have targeted it include Der Spaeher, Direct Connection, GOTHIC Intruder, and Theef [^1]. Veritas Backup Exec had documented vulnerabilities on this port [^1]. The lack of an official service means less visibility, less monitoring, and easier concealment.

How to Check What's Listening

To see if anything is listening on port 1000 on your system:

On Linux/macOS:

lsof -i :1000
netstat -tulpn | grep 1000
ss -tulpn | grep 1000

On Windows:

netstat -ano | findstr :1000
Get-NetTCPConnection -LocalPort 1000

Protocol: Both TCP and UDP versions exist, though TCP is more common.

Why Unassigned Ports Matter

An unassigned port in the well-known range is a contradiction. The whole point of well-known ports is predictability—you know SSH is 22, SMTP is 25. Port 1000 breaks this contract. It's a place where legitimate infrastructure and malware can coexist, neither fully official, both claiming the same space. It's a reminder that IANA's authority has gaps, and those gaps get filled by whoever moves fast enough.