Port 115: SFTP — The Forgotten Original

Port 115 is assigned to SFTP, the Simple File Transfer Protocol. Not the SFTP you're thinking of. The other one. The one from 1984 that almost nobody uses anymore.

This is the story of a protocol that lost its own name.

What Runs on Port 115

Port 115 carries the Simple File Transfer Protocol, defined in RFC 913¹. It was designed by Mark K. Lottor at MIT in September 1984 as a middle ground between two extremes: TFTP (Trivial File Transfer Protocol), which was simple but too limited, and FTP (File Transfer Protocol), which was powerful but complex to implement.

SFTP uses a single TCP connection. It supports user authentication, file transfers, directory listing, file renaming, and deletion. Commands are ASCII text followed by a null character. Responses come back as single-character codes: + for success, - for error, ! for success with message, # for success with data following.

The protocol runs in three modes: ASCII (with line-ending conversion), binary (raw 8-bit bytes), and continuous (for systems with unusual word boundaries).

The Name Collision

Here's where it gets interesting.

In 1997, Tatu Ylönen (the creator of SSH) developed a new file transfer protocol that ran over Secure Shell. It was called the SSH File Transfer Protocol. Its abbreviation? SFTP.

Same acronym. Completely different protocol. No relation whatsoever.

Today, when someone says "SFTP," they mean the secure one, the one that runs over SSH on port 22. The original SFTP on port 115 has been relegated to "Historic" status by the IETF². It never gained widespread adoption, and now it exists primarily as a source of confusion for anyone who encounters the old documentation.

The Creator

Mark K. Lottor went on to become a significant figure in Internet history. He created the Internet Domain Survey, which counted every host on the Internet by crawling the Domain Name System³. When the survey began, there were only a few hundred hosts. By the time it ended in 2019, it had tracked the Internet's growth to over a billion machines.

He authored RFC 1296, "Internet Growth (1981-1991)," documenting the expansion of the network⁴. He was a member of the IETF for over four years, primarily in the DNS working group, and founded Catalog.Com, one of the first web hosting services.

The Simple File Transfer Protocol was his first RFC. It was a reasonable idea at a reasonable time. It just didn't win.

Security Considerations

Simple File Transfer Protocol has no encryption. Every command, every response, every byte of transferred data moves across the network in plaintext. Authentication credentials are visible to anyone watching the wire.

This is one reason the protocol never caught on. Even in 1984, people understood that sending passwords in cleartext was problematic. By the time secure alternatives emerged, there was no reason to adopt the insecure middle path.

Port 115 has been associated with malware communications in the past⁵. If you see unexpected traffic on this port, investigate. Legitimate SFTP (the simple kind) is rare enough that any activity should be verified.

How to Check What's Listening

macOS/Linux:

# Check if anything is listening on port 115
sudo lsof -i :115

# Or with netstat
netstat -an | grep 115

Windows:

# Check port 115
netstat -an | findstr :115

If something is listening on port 115 and you didn't put it there, that's worth investigating.

Why This Port Matters

Port 115 is a reminder that being first doesn't mean winning. The Simple File Transfer Protocol got the acronym, the well-known port, and the RFC. The SSH File Transfer Protocol got adoption.

Sometimes the better solution arrives later and takes the name anyway. Sometimes a protocol's greatest legacy is the confusion it causes when someone encounters the old documentation and wonders why SFTP is listed as insecure and running on port 115 instead of 22.

The Internet is full of these quiet ghosts: protocols that almost worked, standards that almost caught on, solutions that were good enough until something better came along. Port 115 stands open, assigned to a protocol that nobody uses, carrying a name that now belongs to something else entirely.

Summary