Port 198 sits in the well-known ports range (0-1023), officially assigned and properly documented, waiting for traffic that never came. It was registered in 1990 for "dls-mon" (Directory Location Service Monitor), a companion to the Directory Location Service on port 197. Both protocols are relics from the Internet's early days—properly reserved but never widely deployed.
What Port 198 Was Meant For
Port 198 was assigned for the Directory Location Service Monitor on both TCP and UDP. The assignment first appeared in RFC 1060 (March 1990) and was maintained through subsequent RFCs documenting assigned numbers.12
The Directory Location Service was an early attempt at building network directory infrastructure—a way for systems to locate and identify resources across networks. Port 197 carried the directory service itself, and port 198 was designated for monitoring that service.
The assignment was registered by Scott Bellew in 1990, during an era when the Internet's port namespace was being actively carved out and reserved for protocols that might become important infrastructure.3
Why It Never Took Off
The Directory Location Service never achieved widespread deployment. By the mid-1990s, other directory protocols emerged and gained traction:
- LDAP (Lightweight Directory Access Protocol) became the dominant directory service
- DNS already handled name-to-address resolution
- The specific problem DLS was designed to solve was addressed by other, more successful protocols
Port 198 remains officially assigned to dls-mon in the IANA registry, but you will not find it in active use on modern networks.4
The Ghost Town of Well-Known Ports
Port 198 is not unusual. The well-known ports range (0-1023) is full of assignments like this—protocols that were registered in the 1980s and 1990s, properly documented, and then never deployed at scale.
These ports represent the Internet's optimism and caution in equal measure: reserve the namespace early, just in case this protocol becomes critical infrastructure. Some of those reservations became the foundations of the Internet (HTTP on 80, HTTPS on 443, SSH on 22). Others became historical footnotes.
Port 198 is a footnote with a three-decade reservation.
Security Considerations
Because port 198 has no active, legitimate service commonly running on it, any traffic on this port should be investigated. Some security databases have flagged port 198 as having been used by malware in the past, though this is not a current widespread threat.5
If you see port 198 open and listening on a system:
- It is almost certainly not the Directory Location Service Monitor
- It may be malware or an unauthorized service
- Investigate what process is bound to the port
How to Check Port 198
On Linux or macOS:
On Windows:
If something is listening, identify the process and determine if it is legitimate.
Related Ports
- Port 197: Directory Location Service (DLS) — the companion protocol that port 198 was meant to monitor
- Port 2048: dls-monitor — a different service sometimes confused with port 198's dls-mon
Why Unassigned and Unused Ports Matter
The Internet's port system is a finite namespace. Ports 0-1023 are the well-known range, assigned only through IETF review or IESG approval. Once assigned, a port stays assigned, even if the protocol dies.
Port 198 is a reminder that infrastructure planning involves trade-offs: reserve too conservatively and you might not have space when you need it; reserve too liberally and you create a namespace cluttered with unused assignments.
The Directory Location Service Monitor got its port in 1990. It has held that reservation for over 30 years. The service never came. The port remains.
Frequently Asked Questions
Was this page helpful?