Port 140: EMFIS Data Service — A Cold War Ghost in the Port Registry

Port 140 is assigned to the EMFIS Data Service. If you've never heard of EMFIS, you're in good company. Almost nobody has.

What EMFIS Was

EMFIS stands for Experimentelles Führungsinformationssystem, which translates to "Experimental Command Information System." It was a military management information system developed at FGAN (Forschungsgesellschaft für Angewandte Naturwissenschaften), a German defense research establishment located in Wachtberg, just outside Bonn.¹

The system ran on a Siemens mainframe with the BS2000 operating system. At some point, researchers implemented a TCP/IP interface so the system could be accessed remotely via ASCII line terminals on the ARPANET, rather than through the native Siemens page-oriented terminals.²

That TCP/IP interface is why port 140 exists in the IANA registry today.

The Port Assignment

Port 140 was registered for EMFIS Data Service (emfis-data) on both TCP and UDP. Its companion, port 141, was assigned to EMFIS Control Service (emfis-cntl), providing a separate control channel.³

The contact person listed in RFC 1340 is Gerd Beling, identified by the reference tag [GB7], affiliated with FGAN, reachable at GBELING@ISI.EDU.⁴

Two ports, permanently carved into the Internet's address book. One for data, one for control. A clean, simple architecture for a system that was experimental from the start.

The Organization Behind It

FGAN was a constellation of three institutes doing defense research for the Bundeswehr:

• FHR: High-frequency physics and radar
• FKIE: Communication, information processing, and ergonomics
• FOM: Optronics and pattern recognition

The institutes began decades earlier as university workshops and were consolidated into FGAN in 1999. In 2009, FGAN was absorbed into the Fraunhofer Society, becoming Fraunhofer FKIE.⁵ Today, Fraunhofer FKIE continues to develop command-and-control systems and cybersecurity solutions for the German armed forces.

EMFIS itself is long gone. The Siemens mainframe it ran on is long gone. But port 140 remains in the registry, a permanent artifact of an experimental system that once bridged Cold War-era German military research to the nascent Internet.

A Port That Outlived Its Purpose

You will not encounter EMFIS Data Service traffic on port 140 today. The protocol has no modern implementations, no active users, no maintained software. If you see traffic on port 140, it is not EMFIS. It is something else using an unoccupied port number.

This is what makes port 140 interesting: it sits in the well-known range (0 to 1023), the ports reserved for system services and assigned by IANA through formal review processes.⁶ Getting a well-known port number is not easy. Someone had to make the case that this service mattered enough to deserve a permanent, privileged slot in the Internet's architecture.

They made that case. They got the port. The system served its purpose and disappeared. The port number stayed.

How to Check What's Using Port 140

On most systems, port 140 sits silent. But if you want to check:

Linux/macOS:

sudo lsof -i :140
sudo netstat -tlnp | grep :140
ss -tlnp | grep :140

Windows:

netstat -an | findstr :140

If something is listening on port 140, investigate it. No widely-used modern software targets this port, so unexpected listeners warrant attention.

Security Considerations

Port 140 has no known widespread vulnerabilities because there is no widely-deployed software using it. However, well-known ports in the low range (0 to 1023) require elevated privileges to bind on Unix-like systems, which provides a basic layer of protection against unprivileged processes claiming them.

Some historical threat databases flag port 140 in connection with trojan activity, but this reflects the general pattern of malware occasionally using obscure assigned-but-unused ports to avoid detection, not a vulnerability in EMFIS itself.⁷

Related Ports

Ports 140 and 141 form a pair: data and control. This two-port architecture, separating the data plane from the control plane, is a pattern you see throughout networking. FTP uses ports 20 and 21. SIP uses port 5060 alongside RTP on dynamic ports. The idea that commands and data should travel on different channels is fundamental to protocol design, and EMFIS followed it faithfully.