Port 173: Xyplex-mux — The Abandoned Storefront

Port 173 is a ghost town. It was officially assigned to something called Xyplex-mux, a multiplexing service for Xyplex terminal servers. If you don't know what a Xyplex terminal server is, that's the point. Nobody does anymore.

What Xyplex-mux Was

In the 1980s and early 1990s, Xyplex made terminal servers—devices that let multiple users connect to a central computer through serial terminals. The "mux" in Xyplex-mux stands for multiplexing, which means combining multiple signals into one connection.¹

Port 173 was assigned to this service by IANA. The contact person was Bob Stewart. The protocol is now considered historic, meaning it's officially dead.

The Well-Known Port Range

Port 173 sits in the well-known port range (0-1023). These are the most privileged addresses in the Internet's numbering system. On Unix-like systems, you need superuser privileges to bind a service to one of these ports.²

This range was designed for fundamental Internet protocols—services that everyone needs. SSH on port 22. DNS on port 53. HTTPS on port 443.

Port 173 got one of these valuable addresses for a protocol that no longer exists.

What Actually Uses Port 173 Now

Nothing legitimate. The port is officially assigned but practically empty.

The only documented activity is malware. Trojans and viruses have used port 173 in the past to communicate with command-and-control servers.³ This doesn't mean a virus is currently using port 173—it means malware authors occasionally remember this abandoned address exists.

Security scanners also check port 173, looking for anything listening. The SANS Internet Storm Center tracks port 173 activity and reports minimal traffic.⁴

Why This Matters

Port 173 represents something important about how the Internet ages. Protocols die. Companies disappear. But the port assignments remain, like digital gravestones marking where something used to be.

The well-known port range is finite. There are only 1,024 addresses. Once something is assigned, it's effectively claimed forever. Port 173 is claimed by a protocol nobody uses, sitting in the most valuable real estate on the Internet.

How to Check What's Listening

If you want to see if anything is listening on port 173 on your system:

# On Linux or macOS
sudo lsof -i :173
sudo netstat -tuln | grep 173

# On Windows
netstat -an | findstr :173

If nothing returns, nothing's listening. That's what you should see.

The Pattern

Port 173 is one of hundreds of ports assigned to protocols that have vanished. The IANA registry is full of them—services assigned in the 1970s and 1980s that made sense at the time but are now archaeological artifacts.

The Internet doesn't forget. It just stops visiting.

Security Note

If you find something listening on port 173, investigate it. There is no legitimate modern service that should be using this port. It's either legacy equipment running ancient software, or something you don't want on your network.

Related Ports

• Port 22 — SSH, the protocol that replaced telnet and made terminal servers obsolete
• Port 23 — Telnet, another protocol Xyplex terminal servers connected to
• Port 513-514 — rlogin and rsh, other remote access protocols from the same era