Port 166: S-Net — A Ghost in the Registry

Port 166 is assigned to a service called S-Net, registered by Sirius Systems.¹ If you've never heard of either, that's because the company has been dead for over forty years and the protocol left no trace beyond its name in a registry file.

This is a ghost port. Officially assigned, practically empty.

What S-Net Was

The IANA registry lists port 166 for both TCP and UDP under the service name s-net, described simply as "Sirius Systems." The contact on the registration is Brian Lloyd, a networking engineer who would later become known for his work on PPP (Point-to-Point Protocol) at the IETF.²

The assignment appears as early as RFC 990 (1986) and persists through RFC 1060 (1990), RFC 1340 (1992), and RFC 1700 (1994), always with the same terse entry:³

s-net    166/tcp    Sirius Systems
s-net    166/udp    Sirius Systems

No RFC defines the S-Net protocol. No specification survives. The name suggests a proprietary networking system, likely designed for Sirius Systems Technology's hardware, but no technical documentation has surfaced in any digital archive.

The Company Behind It

Sirius Systems Technology was a personal computer manufacturer in Scotts Valley, California, founded in 1980 by Chuck Peddle, the lead designer of the MOS 6502 microprocessor (the chip inside the Commodore 64 and Apple II).⁴

Their product was the Victor 9000, sold in Europe as the Sirius 1. It ran CP/M-86 and MS-DOS but was not IBM PC compatible. It had a higher resolution display and larger floppy drives than the IBM PC. While it failed in North America, the Victor 9000 became the most popular 16-bit business computer in Europe, particularly in Britain and Germany, during a window when IBM had not yet launched the PC there.⁴

In late 1982, Sirius acquired Victor Business Systems and renamed itself Victor Technologies. The company went public in early 1983. By the end of 1984, it was in Chapter 11 bankruptcy.⁴

S-Net was almost certainly a networking protocol for connecting Victor 9000 machines. The Victor 9000 is known to have supported the Corvus Omninet local area network, and archived software includes networking configuration tools.⁵ Whether S-Net was a distinct protocol, a branded wrapper around Omninet, or something else entirely is now unknown. The documentation did not survive the bankruptcy.

The Port Today

Port 166 sees no legitimate traffic. No modern software uses it. No protocol specification exists for it.

The only notable activity on port 166 comes from the wrong side of the network. The NokNok trojan, a Windows 95/98-era backdoor written in Lithuania, used port 166 for command-and-control communication.⁶ It is classified as a remote access trojan capable of file transfer, password theft, and port scanning. The trojan is ancient by malware standards, but port 166's association with it persists in threat databases.

Port Range Context

Port 166 sits in the well-known port range (0 through 1023). These ports are controlled by IANA and on most Unix-like systems require root privileges to bind. The well-known range was originally 0 through 255, later expanded to 0 through 1023.³

Being in this range means port 166 was assigned through formal IANA procedures. It was given to Sirius Systems with the expectation that S-Net would become a recognized Internet service. That never happened.

How to Check What's Listening on Port 166

On macOS or Linux:

# Check if anything is listening on port 166
sudo lsof -i :166

# Or using ss (Linux)
ss -tlnp | grep :166

# Or using netstat
netstat -an | grep 166

On Windows:

netstat -an | findstr :166

If something is listening on port 166 and you didn't put it there, investigate immediately. There is no legitimate modern service that uses this port.

Why Ghost Ports Matter

The IANA Service Name and Transport Protocol Port Number Registry contains over 10,000 entries.¹ Many of them, like port 166, point to companies and protocols that no longer exist. These assignments are never reclaimed. Once a port number is given, it stays given, even if the recipient disappears.

This is by design. Port numbers are not domain names. They don't expire. Reassigning a port that some legacy system somewhere might still expect to use would create silent, impossible-to-debug failures. So the registry accumulates history like sediment. Every entry is permanent. Every entry is a record of someone who once needed a number, got one, and either built something lasting or didn't.

Port 166 is a reminder that the infrastructure of the Internet is not just protocols and packets. It's a record of ambition, of companies that tried to build something, of engineers who registered a port number because they believed their protocol would matter. Sometimes it did. Sometimes the company went bankrupt and the protocol vanished, and all that's left is three letters in a text file: s-net.