Port 168: RSVD — The Reservation That Never Checked In

Port 168 is registered in the IANA Service Name and Transport Protocol Port Number Registry under the service name "RSVD," for both TCP and UDP.¹ The name almost certainly stands for "Reserved." It sits in the well-known port range (0 through 1023), meaning it was formally assigned by IANA and would require IETF Review or IESG Approval to reassign.²

No known protocol runs on port 168. No RFC defines a service for it. No widely deployed software listens on it by default.

The History of a Placeholder

Port 168 appears in RFC 1340, the "Assigned Numbers" document published in July 1992, listed as rsvd 168/tcp RSVD and rsvd 168/udp RSVD with the contact reference [NT12].³ That reference was a NIC identifier, the kind of shorthand used in the early days when port assignments were managed through a more informal process.

By 2008, the IANA registry was updated to list the contact as Alan Sandell, with a modification date of May 1, 2008.¹ Whether this reflects a handoff, a cleanup of legacy records, or simply a registry modernization is unclear.

What is clear is that whatever RSVD was supposed to become, it never became it. The reservation has outlived the intention by at least three decades.

What the Well-Known Range Means

Ports 0 through 1023 are the well-known ports, also called system ports. On most operating systems, binding to a port in this range requires elevated privileges (root or administrator access). These ports were historically reserved for critical Internet infrastructure: HTTP on 80, HTTPS on 443, SSH on 22, DNS on 53.

Port 168 occupies a seat at this table. It has the privileges and protections of the well-known range. It just never had anything to say.

Security Considerations

Because port 168 has no legitimate service associated with it, any traffic on this port is worth investigating. Some security databases have flagged port 168 as historically associated with trojan or malware communication.⁴ This does not mean port 168 is inherently dangerous. It means that malware authors, like anyone looking for an unused door, sometimes pick ports that no one is watching.

If you see traffic on port 168, do not assume it is benign. Legitimate software has no reason to use it.

How to Check What Is Listening on Port 168

Linux:

sudo ss -tlnp | grep :168
sudo lsof -i :168

macOS:

sudo lsof -i :168

Windows:

netstat -an | findstr :168

If anything is listening on port 168 and you did not put it there, investigate immediately.

The Role of Unassigned Ports

The Internet has 65,535 ports. Of those, only a fraction carry assigned protocols. The rest are available, waiting, or reserved. Ports like 168 serve a purpose even in their emptiness: they are part of the structure. IANA manages the registry carefully, ensuring that ports are not carelessly reassigned even after deassignment, because old software may still expect to find something at a particular number.²

An unassigned port is not a wasted port. It is a port that has not yet found its purpose, or one whose purpose came and went so quietly that no one noticed.

Port 168 was reserved. The reservation was honored. Nothing ever arrived to claim it.