Port 159: NSS-Routing — The Backbone That Learned to Route

Port 159 is assigned to NSS-Routing, the internal routing protocol of the NSFNET backbone network. If you have never heard of it, that is because it did its job so well that the Internet grew past it. But for a few critical years in the late 1980s and early 1990s, this protocol helped route packets across the thirteen nodes that formed the spine of the American Internet.

What Ran on Port 159

NSS-Routing was the Interior Gateway Protocol (IGP) used by the Nodal Switching Systems (NSSes) of the NSFNET backbone.¹ Each NSS was a cluster of IBM RT PC systems connected by a Token Ring LAN, and together they formed a nationwide packet-switching network running at T1 speed (1.544 Mbps).²

The protocol used a Shortest Path First (SPF) algorithm, adapted from the ANSI IS-IS standard for the Internet environment. It flooded address information across all backbone nodes, and each node independently computed its own routing table from that flooded data.¹

Port 159 carried these routing updates between the backbone nodes, both over TCP (for reliable exchange) and UDP (for faster flooding). The IANA assignment covers both transport protocols.³

The Story

In 1987, the National Science Foundation awarded a cooperative agreement to Merit Network, IBM, MCI, and the State of Michigan to build and operate the second phase of the NSFNET backbone.² The goal was to connect thirteen sites across the continental United States: the NSF supercomputer centers, the National Center for Atmospheric Research, and several regional networks.

The routing architecture was designed primarily by Yakov Rekhter, working at IBM's Thomas J. Watson Research Center.⁴ Rekhter was one of the leading architects and a major software developer of the NSFNET Backbone Phase II. He wrote the code that ran on those IBM RT PCs, the code that decided how packets moved from one end of the country to the other.

The routing design was deliberately modular. The backbone ran its own internal routing protocol (the SPF-based IGP on port 159), while communication with attached regional networks used the Exterior Gateway Protocol (EGP). This decoupling meant each regional network could run whatever IGP it wanted internally. The backbone did not care, as long as EGP carried the reachability information across the boundary.⁵

This architecture is documented in RFC 1074 ("NSFNET Backbone SPF based Interior Gateway Protocol," October 1988)¹ and RFC 1222 ("Advancing the NSFNET Routing Architecture," May 1991).⁵

The Two-Napkin Protocol

Here is why port 159 matters beyond its own protocol.

In January 1989, at the 12th IETF meeting in Austin, Texas, Yakov Rekhter sat down at a table with Kirk Lougheed from Cisco Systems. The inter-domain routing technology of the time was limited. EGP could signal whether a network was reachable but could not express routing preferences or prevent loops in a meshed topology. The Internet was growing past what EGP could handle.⁶

Rekhter and Lougheed sketched a new protocol on two napkins. Those napkins became three handwritten sheets of paper, which became the first interoperable implementation of the Border Gateway Protocol (BGP).⁶

BGP turned the Internet from a hierarchical tree into a mesh. It is still the protocol that holds the Internet together, over thirty years later. And the person who designed it had spent the previous years writing routing code for thirteen IBM RT PCs on the NSFNET backbone, shipping updates over port 159.

How to Check Port 159

On most modern systems, nothing listens on port 159. The NSFNET backbone was decommissioned in 1995, and NSS-Routing went with it.

To check if anything is using port 159 on your machine:

# macOS / Linux
sudo lsof -i :159

# Linux with ss
sudo ss -tlnp | grep :159

# Windows
netstat -an | findstr :159

If something is listening on port 159 and you did not put it there, investigate. This port is not commonly used by modern software.

Security Considerations

Port 159 has no significant security profile in modern networks. Some historical threat databases flagged it because malware occasionally uses obscure well-known ports to avoid detection, but there are no widely known exploits specific to port 159.

Because NSS-Routing has no modern implementations, the real security concern is the general one: any open port you did not intentionally open is a port you should close.

Technical Details

Related Ports

• Port 179 — BGP, the protocol Rekhter co-created after his work on NSS-Routing
• Port 520 — RIP (Routing Information Protocol), an earlier and simpler routing protocol
• Port 89 — SU/MIT Telnet Gateway, another early well-known port from the same era