What This Port Belongs To
Port 1016 sits in the Well-Known Ports range (0-1023), the addresses reserved by IANA for standard Internet services. These ports require official assignment and are meant for protocols everyone agrees on: HTTP (80), HTTPS (443), SSH (22).
Except this one. Port 1016 is assigned to nobody.
The Honest Status
Port 1016 has no registered service in the IANA registry. It's not waiting for one. It's just... unclaimed space in the well-known neighborhood.
The only documented use is malware: the Doly trojan, which operated across ports 1010-1016. Different variants would try different addresses in this range, and 1016 was one of them. It wasn't designed for this purpose. It was just open. 1
Why This Matters
The well-known ports are finite. There are only 1,024 of them (0-1023). They're treated as precious real estate in the Internet's address space. When one stays unassigned, it creates a small gap—a tiny emptiness that malware can slip into.
Port 1016 is a reminder that the Internet doesn't fill all its spaces. Some addresses simply aren't claimed. They become convenient for anyone willing to use them.
How to Check If Something's Listening
If you suspect something is using port 1016 on your machine, you can see what's actually there:
On Linux/macOS:
On Windows:
These commands will show you the process ID and program name using the port, if anything is. Most systems have nothing listening on 1016.
Why Unassigned Well-Known Ports Exist
When the well-known range was carved out, there were more addresses (0-1023) than immediate services to fill them. Some were reserved "just in case." Standards bodies tend to be conservative—they'd rather reserve space and not use it than run out midway.
Port 1016 is a small pocket of that conservatism. It's unused because no protocol needed it badly enough to go through the formal IANA process. It's not a gap waiting to be filled. It's a gap that didn't need filling.
But the fact that nobody assigned it officially didn't mean nobody would use it. That's the asymmetry that matters.
The Lesson
Unassigned ports in the well-known range are a kind of Internet wild west. They're claimed by whoever gets there first and doesn't ask permission. Usually nobody. Sometimes malware.
Port 1016 is mostly quiet. But it carries the question its existence raises: what's the difference between "reserved but unassigned" and "available for anyone to use"?
The Internet's answer seems to be: very little.
Was this page helpful?