Port 14: The Even-Numbered Ghost — A Relic of Half-Duplex ARPANET

Port 14 has no assigned service. No protocol runs here. No RFC defines its purpose. It sits in the well-known port range (0–1023) as one of the lowest-numbered ports with nothing officially behind it.

This is not an oversight. It is a fossil.

Why Port 14 Is Empty

To understand port 14, you need to understand how the ARPANET worked before TCP/IP existed.

In the early 1970s, the ARPANET ran on the Network Control Program (NCP), a protocol where connections were simplex — one-way only.¹ If two machines wanted to talk to each other, they needed two separate connections: one for sending and one for receiving. The convention was straightforward: odd-numbered sockets handled one direction, even-numbered sockets handled the other.²

So when Jon Postel published RFC 349 in May 1972, proposing standard socket numbers for the ARPANET, every service got an odd number.³ Telnet got socket 1. File Transfer got socket 3. Echo got socket 7. Daytime got socket 13. The even numbers — 2, 4, 6, 8, 10, 12, 14 — were reserved as their return-traffic companions.

Port 14 was the other half of port 13's Daytime protocol connection. It existed so that when you asked a machine "what time is it?" on socket 13, the answer could flow back to you on socket 14.

Then TCP arrived.

On January 1, 1983 — a date known as Flag Day — the ARPANET switched from NCP to TCP/IP.⁴ TCP connections are full-duplex: both directions on a single port. The entire concept of needing a paired return socket vanished overnight.

Port 13 kept its Daytime assignment. Port 14 lost its reason to exist. It has remained unassigned ever since.

The Well-Known Port Range

Port 14 sits in the well-known port range (0–1023), which is controlled by IANA and requires IETF Review or IESG Approval for new assignments.⁵ These are the most regulated ports in the entire numbering system. Getting a port number here is like getting a reserved seat at the table where the Internet's core protocols sit.

Many of the even-numbered well-known ports share port 14's fate: ports 4, 6, 8, 10, and 12 are all unassigned for the same historical reason. They are the paired ghosts of NCP's simplex era, each one the silent return channel for the odd-numbered service beside it.

Security

Port 14 is not commonly associated with any known malware or trojan. It does not appear on standard threat lists. However, any traffic on an unassigned port warrants investigation — if something is listening on port 14, it was put there deliberately, and you should find out why.

How to Check What Is Listening on Port 14

Linux/macOS:

sudo lsof -i :14

sudo ss -tlnp | grep ':14 '

Windows:

netstat -ano | findstr :14

If any process is bound to port 14, these commands will show you what it is. On a clean system, nothing should be there.

Port 14's Neighbors