Port 1005 — Unassigned, Once Used, Now Ghost Frequency

The Well-Known Ports Range

Port 1005 sits in the well-known ports range (0-1023), which are reserved by IANA for system-level services and protocols defined by official standards. These ports are meant for infrastructure, for the foundational protocols that keep networks breathing. They're assigned through formal review processes, meant to prevent chaos when everything connects to everything else. ¹

Port 1005 has an entry in the official IANA registry, but like many ports in this range, it's become a historical artifact—assigned, documented, but not actively in use by any current standard protocol.

What Lived Here

NetInfo — macOS Network Administration

Port 1005 was historically associated with NetInfo, Apple's RPC-based network information system used in Mac OS X for local network configuration and authentication. NetInfo lived in the 600-1023 range on macOS systems and was the way the system talked to itself about users, networks, and services. ²

But NetInfo didn't survive modern macOS. Apple deprecated it, then removed it. By Mac OS 10.5 Leopard, it was gone. The port went silent.

Theef — The Trojan Phase

Then port 1005 got used by something else: Theef, an anti-protection trojan that emerged in the late 1990s and early 2000s targeting Windows 95, 98, ME, and XP. Theef was a remote access trojan with keylogger capabilities, an FTP server, and port proxy functionality. It could watch you, steal from you, serve files from your machine without your knowledge. ³

The irony is structural: a port that handled legitimate system administration got weaponized to handle illegitimate theft.

Today: Empty Frequency

Port 1005 is now mostly unused. NetInfo is gone. The Windows machines Theef targeted are long since replaced. If you scan a modern system and find port 1005 listening, it's unusual—a sign that something unexpected is running, or that someone misconfigured something very old.

How to Check What's Listening

To see if anything is actually listening on port 1005 on your system:

On Linux/macOS:

# Using netstat (older)
netstat -tlnp | grep 1005

# Using ss (modern)
ss -tlnp | grep 1005

# Using lsof (most direct)
lsof -i :1005

On Windows:

netstat -ano | findstr :1005

Why Unassigned Ports Matter

The existence of port 1005—assigned but unused, documented but irrelevant—illustrates something important about port space: it's finite. There are only 65,535 ports total, and the well-known range (0-1023) is the most contested real estate. Every port that gets reserved by a standard but then abandoned is port space that can't be reused for something new without potentially breaking legacy systems that might still expect the old service.

Port 1005 is a ghost frequency. It exists in the official registry, but nothing substantial runs on it anymore. It's a reminder that the Internet is built on layers of time—some still working, some preserved in documentation, some abandoned entirely.