Port 116: ANSA REX Notify — A Ghost of Distributed Computing

What Port 116 Does

Port 116 is assigned to ANSA REX Notify, a notification service that was part of the ANSA (Advanced Networked Systems Architecture) distributed computing framework. It is registered with IANA for both TCP and UDP.¹

If you run a port scan today and find something listening on port 116, it is almost certainly not ANSA REX Notify. The software that used this port has not been actively deployed in decades.

The ANSA Project

ANSA was a British research program that ran from 1985 to 1999, born out of the UK's Alvey Programme, a government initiative to keep British computing competitive.² The project was led by Andrew Herbert, who left the University of Cambridge Computer Laboratory, where he had worked under Maurice Wilkes and Roger Needham, to found Architecture Projects Management Ltd (APM) in Cambridge, England.³

The goal was ambitious: build a complete architecture for distributed computing that could work across heterogeneous networks and platforms. In the mid-1980s, this was still an unsolved problem. Computers from different vendors could barely talk to each other. ANSA aimed to create a framework where distributed objects could find each other, communicate, and coordinate across any network.

The project introduced concepts that would later become foundational:

• Distributed object management for coordinating software components across machines
• Trading services for discovering and matching services by their properties (port 124, ansatrader)
• Notification services for event propagation between distributed components (port 116, ansanotify)

The "REX" in ANSA REX stood for the Remote EXecution protocol, the core communication layer that handled remote procedure calls between distributed objects.⁴

How REX Notify Worked

In a distributed system, components need to know when things change. A service comes online. A resource becomes unavailable. A computation finishes. ANSA REX Notify was the mechanism for this: an event notification service that allowed distributed objects to subscribe to events and receive callbacks when those events occurred.

Port 116 carried these notifications. Port 124 carried the trading protocol, where services advertised their capabilities and clients discovered them. Together, they formed two halves of ANSA's service coordination layer: finding services and being told when something about them changed.

What ANSA Left Behind

ANSAware, the software implementation of the ANSA architecture, was used by real organizations in the 1990s. NASA's Astrophysics Data System ran on it. A European radio pager system used it. A major UK utility built its customer service system on it.³

More importantly, Herbert and the ANSA team were deeply involved in shaping the standards that followed: CORBA (Common Object Request Broker Architecture), RM-ODP (Reference Model of Open Distributed Processing), and OSF DCE (Distributed Computing Environment).³ The ideas that ANSA pioneered, service trading, distributed object notification, platform-independent middleware, became the vocabulary of enterprise distributed computing for the next two decades.

In 1998, Citrix Systems acquired APM and its spinoff Digitivity. Herbert joined Citrix as Director of Advanced Technology. The ANSA project was over.³

The ports remained.

Security Considerations

Port 116 has been associated with a threat called "DiabloBekkoame" on UDP in some security databases.⁵ This does not mean the port is inherently dangerous. It means that at some point, malware chose port 116 for communication, likely because it was assigned but unused, making it inconspicuous.

This is the paradox of abandoned well-known ports: they have the prestige of an official IANA assignment but no legitimate software listening on them. That makes them attractive to malware authors looking for ports that will not conflict with real services.

If you see traffic on port 116, investigate it. There is no modern software that should be using it.

How to Check What Is Listening on Port 116

# macOS / Linux
sudo lsof -i :116
netstat -tuln | grep ':116'

# Windows
netstat -an | findstr ":116"

# Using nmap to scan a remote host
nmap -p 116 <target-ip>

The Significance of Unassigned Well-Known Ports

Port 116 sits in the well-known port range (0 to 1023), which is governed by IANA and requires IETF Review or IESG Approval for assignment.⁶ Getting a port in this range was a mark of legitimacy. It meant the Internet's governing bodies recognized your protocol as important enough to deserve a reserved number that only privileged processes could bind to.

Some of these assignments outlived the projects they were created for. Port 116 is one of them. The ANSA project ended over twenty-five years ago, but its port assignment persists in every IANA registry mirror, every firewall rule database, every port scanning tool. It is a permanent entry in the Internet's ledger for a project that most network engineers have never heard of.

These ghost ports serve a purpose, though. They are part of the archaeological record of distributed computing. Every assigned port in the well-known range represents a moment when someone built something they believed would be permanent infrastructure. Some of those bets paid off. Port 80 carries the web. Port 443 encrypts it. Port 22 secures remote access.

Port 116 carried notifications between distributed objects in a Cambridge research lab. The research changed the field. The port number is what remains.

Related Ports