Port 154: NETSC — The Backbone Builder's Forgotten Service

Port 154 is registered with IANA under the service name netsc-prod, described simply as "NETSC." It runs on both TCP and UDP. Its sibling, port 155, is registered as netsc-dev, the development counterpart.¹

That is nearly everything the official record tells us. But the story of who registered this port is far more interesting than the port itself.

What We Know

The IANA assignment for port 154 traces back to Sergio Heker, registered under the email address heker@JVNCC.CSC.ORG.¹ JVNCC stands for the John von Neumann Center for Computing, part of a consortium that operated one of the National Science Foundation's original supercomputer centers in the 1980s.

The naming convention tells us something: "netsc-prod" for port 154, "netsc-dev" for port 155. This was a production/development pair, a pattern that suggests a network service serious enough to warrant separate environments. Beyond that, the specific function of NETSC has not survived in any public documentation. Cisco's NBAR2 protocol classification system categorizes it simply as "other" with a traffic class of "bulk-data."²

The Person Behind the Port

Sergio Heker built the John von Neumann National Supercomputer Network in 1985, expanding it into what was at the time the fastest Internet network and the largest international carrier in the world.³ He was the first to co-locate equipment with telecommunications providers, a practice that helped create the original backbone of the Internet as we know it.

In 1988, when the Morris Worm spread across the Internet and brought roughly 10% of all connected machines to a halt, Heker was one of the people who helped contain it. He later testified before the United States Congress on Internet security.³

Port 154 was one small piece of infrastructure registered by someone who was building the infrastructure itself.

The Well-Known Range

Port 154 sits in the System Ports range (0 through 1023), also called well-known ports.⁴ These ports are controlled by IANA and require IETF Review or IESG Approval to assign. In the early days of networking, this range was parceled out to protocols and services that the Internet's builders deemed important enough to deserve a reserved number.

Not all of those services survived. Some, like HTTP on port 80 and SSH on port 22, became load-bearing pillars of modern life. Others, like NETSC on port 154, served their purpose and quietly stepped offstage. The port number remains reserved, a permanent entry in the registry, even though the service it was meant to carry has gone silent.

Security Considerations

Because port 154 has no widely running modern service, any traffic on this port is unusual and worth investigating. Some security databases have flagged TCP port 154 as historically associated with trojan or malware communication.⁵ This does not mean the port is inherently dangerous. It means that attackers sometimes choose obscure, low-traffic ports precisely because they are unlikely to be monitored.

If you see traffic on port 154, do not assume it is legitimate. Investigate.

How to Check What Is Listening on Port 154

Linux:

sudo ss -tlnp | grep :154
sudo lsof -i :154

macOS:

sudo lsof -i :154
netstat -an | grep '\.154 '

Windows:

netstat -ano | findstr :154

If something is listening on port 154 and you did not put it there, find out what process owns it before doing anything else.

Related Ports