What Port 169 Does
Port 169 is assigned to a protocol called SEND. That is nearly everything the Internet knows about it.
The IANA Service Name and Transport Protocol Port Number Registry lists port 169 for both TCP and UDP, assigned to "SEND."1 The assignment appears in RFC 1700, the historic "Assigned Numbers" document published by Jon Postel and Joyce Reynolds in October 1994.2 The contact listed for this assignment was William D. Wisner, reachable at an email address at the University of Alaska Fairbanks.
There is no standalone RFC defining the SEND protocol. There is no public specification describing what it does, how it works, or what problem it was meant to solve. The protocol exists as a name in a registry and nothing more.
Important: This SEND protocol on port 169 has no relation to SEcure Neighbor Discovery (SEND), which is defined in RFC 3971 and operates as an extension to IPv6 Neighbor Discovery Protocol.3 The identical name is a coincidence.
The Well-Known Port Range
Port 169 falls within the system port range (0 through 1023), also called the well-known ports. IANA controls these assignments, and on most operating systems, only privileged processes can bind to them.4
This range contains the foundational protocols of the Internet: HTTP on port 80, SSH on port 22, DNS on port 53, SMTP on port 25. Port 169 sits among them, carrying a name but no traffic.
A Ghost in the Registry
RFC 1700 was a snapshot of every protocol parameter assignment as of 1994. Many of its entries describe protocols that were thriving at the time. Some describe protocols that were already fading. And a few describe protocols that never fully materialized, protocols that were assigned a port number during the early days when the process was less formal, when a request to Jon Postel could result in a permanent reservation.
Port 169 appears to be one of these. William D. Wisner registered it, the name SEND was recorded, and the Internet continued building around it. RFC 1700 was later marked as historic and replaced by the online IANA registry,5 but the SEND assignment persisted, carried forward into the living database where it remains today.
The 169 Coincidence
Anyone who has troubleshot a Windows network has seen the number 169 in a different context: the 169.254.x.x address range. When a device fails to reach a DHCP server, it assigns itself an address from this block using Automatic Private IP Addressing (APIPA), defined in RFC 3927.6
This is purely coincidental. The 169 in the APIPA address range has no connection to TCP/UDP port 169. IP addresses and port numbers are separate systems. But it means the number 169 carries a particular association for network administrators: something that should have connected but did not.
Security
Port 169 has been flagged in some security databases as a port historically used by trojans for command-and-control communication.7 This is common for obscure, rarely monitored ports. Attackers prefer ports that administrators are unlikely to notice in logs.
If you see traffic on port 169, investigate. No widely deployed legitimate software uses this port.
How to Check What Is Listening on Port 169
Linux:
macOS:
Windows:
If anything is listening on port 169, identify the process. On a typical system, nothing should be.
Why Unassigned Ports Matter
The Internet's port system works because of agreement. Ports 0 through 1023 are reserved so that fundamental services have predictable addresses. When you connect to port 80, you expect a web server. When you connect to port 22, you expect SSH.
Ports like 169, with assignments that never became real protocols, are reminders that the port system was built by humans making practical decisions. Not every reservation led to something. Not every name on a door became a room anyone entered. The system still works because the ports that matter are used consistently, and the empty ones stay quiet.
Frequently Asked Questions
Was this page helpful?