What This Port Is
Port 1923 sits in the registered port range (1024–49151). These are ports that software vendors and protocol designers formally claim through IANA, distinguishing them from the well-known ports below 1024 and the dynamic ephemeral ports above 49151.
IANA's registry shows port 1923 assigned — on both TCP and UDP — to SPICE: the Simple Protocol for Independent Computing Environments.1
What SPICE Is
SPICE was built to solve a specific problem: when you're running a virtual machine, how do you interact with its desktop from across the network in a way that feels real? Not just VNC-style screen scraping, but actual fluency — smooth video, audio playback, USB device forwarding, shared folders.
Qumranet developed SPICE in 2007 while building KVM virtualization infrastructure. Red Hat acquired Qumranet in 2008 and open-sourced SPICE in December 2009, making it a standard component of the Linux virtualization stack.2
Today SPICE is used in QEMU, oVirt, and Proxmox — standard tools for managing virtual machines. But in practice, SPICE connections typically run on port 5900 (shared with VNC) or dynamically assigned ports, not 1923. The IANA registration for 1923 exists on paper; the software moved elsewhere.
What's Actually on This Port
On most machines: nothing. Port 1923 is rarely bound by anything intentional.
The SANS Internet Storm Center records steady scanning activity against port 1923 — not because attackers expect to find SPICE there, but because automated scanners sweep registered ports looking for whatever happens to be listening.3 It's the Internet equivalent of trying every door in a hallway.
If something unexpected is listening on port 1923 on your machine, that warrants investigation.
How to Check What's Listening
On Linux or macOS:
On Windows:
If you get output, the process ID at the end tells you what's holding the port. Cross-reference it with your process list (ps aux on Linux, Task Manager on Windows) to identify the service.
Why Unassigned (and Underused) Ports Matter
The registered port space between 1024 and 49151 has over 48,000 slots. Most are genuinely unassigned. Some, like 1923, are assigned but rarely used. This creates a commons that applications rely on when they need a port that won't conflict with anything else.
When you encounter an open port with no obvious owner, that's worth knowing: it means there's no expected service to hide behind. Anything listening there is either something you put there deliberately, or something you should investigate.
Was this page helpful?