Port 12: Unassigned — The Empty Chair

Port 12 has no assigned service. It has never had one. For as long as IANA has maintained a registry of port numbers, port 12 has been marked "Unassigned" for both TCP and UDP.¹

This makes it one of the lowest-numbered ports on the Internet with no official purpose.

The Well-Known Range

Port 12 belongs to the well-known ports range (0 through 1023), sometimes called system ports. These are the most privileged addresses in networked computing. On Unix-like operating systems, binding to any port in this range requires root or superuser privileges.²

IANA controls this range tightly. You cannot simply claim a well-known port. Assignment requires IETF Review or IESG Approval, as defined in RFC 6335.³ These are ports meant for foundational Internet services: HTTP, SSH, DNS, SMTP, FTP. The protocols that hold everything together.

Port 12 sits in this range but carries nothing.

Its Neighbors

What makes port 12 notable is its context. Look at what surrounds it:

Ports 11 and 13 were both assigned by Jon Postel, one of the original architects of the Internet.⁴ Port 12 sits between two of his creations like an empty chair at a table full of pioneers. Whatever was planned for this slot, if anything, never materialized.

Unofficial Uses

Port 12 has very few documented unofficial uses. SpeedGuide's port database records a reference to Dark Age of Camelot, an MMORPG from 2001, though the game's primary networking uses other ports (notably port 10300 for private servers).⁵ This appears to be a minor or incidental association rather than a meaningful use.

No well-known trojans or malware families are specifically associated with port 12. That said, the absence of a standard service is exactly what makes any traffic on port 12 worth investigating. Legitimate software rarely chooses an unassigned well-known port.

How to Check What Is Listening on Port 12

If you see port 12 open on a system, pay attention. There is no standard reason for it to be open.

On Linux or macOS:

# Check if anything is listening on port 12
sudo lsof -i :12

# Or using ss (Linux)
sudo ss -tlnp | grep ':12 '

# Or using netstat
sudo netstat -tlnp | grep ':12 '

On Windows:

netstat -ano | findstr ":12 "

Remote scanning with nmap:

nmap -p 12 <target-ip>

If something is listening on port 12 and you did not put it there, investigate immediately.

Why Unassigned Ports Matter

It is tempting to think that unassigned ports are uninteresting. The opposite is true.

The well-known port range contains 1,024 slots. Not all of them were claimed. The gaps exist because the early Internet architects assigned ports as protocols were created, not by filling slots sequentially. Port numbers were given to protocols that needed them, and if no protocol needed a particular number, it stayed empty.

These gaps serve a purpose today. An unassigned well-known port is a signal. If traffic appears on port 12, there is no legitimate default explanation. Network monitoring tools and firewalls can treat activity on unassigned well-known ports as inherently suspicious, which makes these empty slots useful for intrusion detection.

The unassigned ports are the silence between the notes. They make the music legible.