Port 128 belongs to the well-known port range (0 through 1023), the most regulated stretch of the Internet's address space. These are ports assigned by IANA under formal review processes, typically reserved for protocols and services considered important enough to warrant permanent allocation.1
Port 128 is assigned. It has a name. And nobody uses it.
What Port 128 Is Assigned To
IANA's Service Name and Transport Protocol Port Number Registry lists port 128 as gss-xlicen, assigned to both TCP and UDP.2 The full name is GSS X License Verification. The registrant is listed as John Light, with a contact email at gssc.gss.com.
The "GSS" refers to the Generic Security Service, a framework defined in RFC 2743 for providing authentication and security services to networked applications.3 The "X" almost certainly refers to the X Window System, the display protocol that powered graphical interfaces on Unix workstations throughout the 1980s and 1990s. Taken together, the name suggests a protocol for verifying software licenses in X Window environments, using GSS-API for authentication.
That is everything the public record can tell you. There is no RFC defining the protocol. No documentation describing its wire format. No open-source implementation. No archived mailing list post announcing it. GSS (the company, apparently Global Solutions Services) appears to have dissolved without leaving a trace on the searchable Internet.
The Ghost in the Registry
Port 128 is a case study in how the IANA registry works and, occasionally, how it accumulates sediment.
In the early days of the Internet, getting a well-known port number assigned was a relatively informal process. You contacted IANA (which at the time meant you contacted Jon Postel), described your protocol, and if the request was reasonable, you got a number.4 The current process, formalized in RFC 6335, requires IETF Review or IESG Approval for system ports.1 But many of the assignments in the 0-1023 range predate that formalization.
Port 128 is one of those early assignments. Someone at GSS needed a port for license verification software. They asked. They received. The software ran its course and disappeared. The port assignment remained, because IANA does not reclaim port numbers. Once assigned, a port keeps its name in the registry, even if the service behind it has been gone for decades.
This is by design. Reclaiming ports would break the one guarantee the registry provides: that a given number always means the same thing. If port 128 were reassigned to something new, any ancient system still running gss-xlicen (however unlikely) would break silently. The Internet chooses haunted houses over demolished ones.
The Well-Known Range
Port 128 sits in the well-known range, ports 0 through 1023. This range has special significance on most operating systems: binding to a well-known port typically requires elevated privileges (root on Unix, administrator on Windows). This restriction exists because these ports were meant to run trusted, system-level services. When you connect to port 80, you can be reasonably confident that a web server placed there by an administrator is responding, not a random user's program.
The well-known range contains 1,024 ports. Many are occupied by the foundational protocols of the Internet: HTTP on 80, HTTPS on 443, SSH on 22, DNS on 53, SMTP on 25. Others, like port 128, are assigned to services that never achieved wide adoption or have long since faded from use.
How to Check What Is Listening on Port 128
On most systems, nothing will be listening on port 128. But if you want to check:
Linux:
macOS:
Windows (PowerShell):
If something is listening on port 128 and you did not put it there, investigate. While port 128 has no widely known association with malware, any unexpected listener on any port deserves attention.
Security
Port 128 does not carry significant security risk in practice because nothing mainstream uses it. Some legacy security databases flag it with a generic warning, noting that trojans have historically used obscure ports for command-and-control communication.5 This is true of virtually every port number and is not specific to 128.
The relevant security principle: if you are not running a service on a port, that port should be closed or filtered at your firewall. Port 128 is no exception.
Why Unassigned and Forgotten Ports Matter
The Internet has 65,535 ports. The well-known range alone has 1,024. Not every one of them carries a protocol that changed the world. Some, like port 128, carry a name from a company that no longer exists, for software that no one remembers running.
These ports matter because the registry itself matters. The IANA port registry is a coordination mechanism, a shared agreement that prevents two different protocols from claiming the same number and colliding in the wild. Every entry in that registry, even the forgotten ones, represents a moment when someone built something and asked the Internet to make room for it. The Internet said yes, and it has not taken that back.
Port 128 is a name on a door. The office is empty. But the building still stands.
Was this page helpful?