Port 146: ISO-TP0 — The Bridge Between Two Internets

The Bridge Between Two Worlds

Port 146 carries ISO-TP0, a bridge protocol that translated between X.25 packet-switched networks and TCP/IP. Defined in RFC 1086¹ in December 1988, it solved a problem that no longer exists: two incompatible networking civilizations needed to talk to each other, and port 146 was the telephone line between them.

When a TCP/IP host needed to reach an X.25 network, it opened a connection to port 146 on the bridge, sent a single byte declaring its intent (connect or listen), followed by the X.25 address it wanted to reach. The bridge then established a parallel connection on the X.25 side and shuffled packets between the two. Simple. Effective. A protocol translator with a one-byte handshake.

The Protocol Wars

To understand why port 146 exists, you need to understand that the Internet almost didn't happen.

In the 1970s and 1980s, two competing visions fought for the future of global networking. On one side: X.25, a virtual circuit protocol standardized by the CCITT (now ITU-T) in 1976². On the other: TCP/IP, the datagram protocol suite growing out of ARPANET research.

X.25 was backed by the European PTTs (state-owned postal, telegraph, and telephone operators) and deployed across over 80 countries². France launched Transpac in 1978, the world's first public X.25 network. The UK followed with Packet Switch Stream. Germany built Datex-P. Japan built DDX. By the mid-1980s, X.25 was the dominant networking technology across Europe and much of the world.

TCP/IP, meanwhile, was spreading through universities and research labs, riding on the popularity of UNIX and local area networks. The two camps were described as fighting a "religious battle" between virtual circuits and datagrams³.

The battle had real consequences. If your organization ran TCP/IP and you needed to reach a host on an X.25 network, you were out of luck. Two networks, two protocol stacks, no common language.

Port 146 was one answer to that problem.

How It Works

The ISO-TP0 bridge protocol is elegantly simple because TP0 (Transport Protocol Class 0) is itself simple. TP0 was designed to run over reliable network services like X.25, where the network handles error correction, flow control, and sequencing. The transport layer barely has to do anything.

RFC 1006⁴ had already shown that TP0 could run over TCP (since TCP also provides reliable, ordered delivery). The insight behind RFC 1086 was: if TP0 can run over both X.25 and TCP, a bridge between them needs only to shuttle TP0 packets back and forth. No deep protocol translation required. Just packaging.

The bridge operates in three phases:

1. Connection establishment: The TCP/IP host connects to port 146 and sends a function code (0x01 to initiate an outbound connection, 0x02 to listen for incoming ones), plus the target X.25 address
2. Data transfer: TP0 packets flow between the TCP and X.25 sides, essentially unchanged
3. Connection release: Either side can close, and the bridge tears down both ends

The People

RFC 1086 was written by Julian P. Onions of the University of Nottingham and Marshall T. Rose of The Wollongong Group¹.

Marshall Rose was one of the most prolific RFC authors of the late 1980s. At The Wollongong Group, a Palo Alto company that was among the first to sell commercial TCP/IP software⁵, Rose worked on the boundary between ISO and Internet protocols. He co-authored RFC 1006 (TP0 over TCP)⁴, RFC 1066 (the first SNMP MIB), and helped create SNMP itself, the protocol that still manages most of the Internet's network devices today.

Julian Onions, working at the University of Nottingham, was deeply involved in the UK's early Internet infrastructure. He co-founded Nexor⁶, which grew out of research into X.400 and X.500 messaging systems and would go on to deploy ALIWEB, one of the first public Internet search engines. Onions later transitioned to astrophysics, running computer simulations of galaxy formation at Nottingham. From bridging network protocols to mapping the structure of the universe.

Why It Matters Now

Port 146 is a ghost. X.25 networks are gone from all but the most specialized applications (some aviation systems still use them). The Protocol Wars ended decisively in TCP/IP's favor by the mid-1990s. Nobody is opening connections to port 146 anymore.

But port 146 tells a story about how the Internet was built. Not as a single coherent vision, but through bridges and translations and compromises between incompatible systems. The Internet won not just because TCP/IP was technically superior (that's debatable), but because people like Rose and Onions built the bridges that let the two worlds coexist long enough for one to absorb the other.

Every bridge protocol is an act of pragmatism. It says: we don't need to agree on everything. We just need to agree enough to talk.

Security

Port 146 has been associated with the "Infector" trojan, a keylogger targeting Windows 95, 98, and ME⁷. This is a common pattern with legacy ports: once their legitimate traffic disappears, the port number becomes useful camouflage for malware. Seeing unexpected traffic on port 146 today should raise questions immediately, since there is no legitimate modern service that uses it.

Checking What Is Listening on Port 146

On most systems, you can check whether anything is bound to port 146:

# macOS / Linux
sudo lsof -i :146

# Linux with ss
sudo ss -tlnp | grep :146

# Windows
netstat -an | findstr :146

If something is listening on port 146 in 2025, it is almost certainly not running ISO-TP0 over X.25. Investigate.

Related Ports