Port 4: Unassigned — The Empty Chair at the Table

Port 4 is unassigned. IANA, the authority that decides which services get which port numbers, has never officially allocated port 4 to any protocol or application¹. It sits in the well-known port range (0 through 1023), the most restricted and privileged addresses in networking, and it is empty.

This makes port 4 unusual. Its neighbors all have jobs. Port 1 runs TCP Port Service Multiplexer. Ports 2 and 3 handle CompressNet. Port 5 runs Remote Job Entry. Port 7 is the Echo protocol. Port 4 is the gap in the sequence, a well-known port that nobody officially knows.

What "Well-Known" Means When Nobody's Home

The well-known port range (0 through 1023) is reserved for system-level services assigned through IETF Review or IESG Approval². On most Unix-like operating systems, binding to a port in this range requires root or elevated privileges. This restriction exists because these ports were designed for foundational Internet services: DNS on 53, HTTP on 80, SMTP on 25.

Port 4 has all the privilege and none of the assignment. According to IANA's registry, it exists in the "Unassigned" state for both TCP and UDP, meaning it is available for assignment if someone submits a valid request through the proper procedures¹. Nobody has.

The One Thing That Tried: Self-Certifying File System

The most notable use of port 4 was unofficial. The Self-Certifying File System (SFS), developed by David Mazières as his doctoral thesis at MIT in 2000, used port 4 for its daemon³⁴.

SFS was an ambitious idea: a global, decentralized file system where file paths contained their own cryptographic proof of authenticity. Instead of relying on a central authority to verify that a file server was who it claimed to be, SFS embedded public keys directly into pathnames. A path like /sfs/hostname:hostID was self-certifying because the hostID was derived from the server's public key. If the server couldn't prove it held the matching private key, the connection failed. No certificate authority needed.

Mazières built SFS on top of NFS version 3 as the underlying file access protocol, which meant it could work on any operating system that supported NFS. The SFS client acted as a translation layer, handling the cryptographic verification transparently.

The idea was elegant. It was also ahead of its time. SFS never achieved wide deployment, and port 4 returned to silence. But the concepts from that thesis influenced later work in secure distributed systems. The notion that a name could carry its own proof of identity echoes in modern technologies like content-addressed storage and self-certifying identifiers.

Other Observed Uses

SpeedGuide's port database lists a few other unofficial sightings on port 4⁵:

• America's Army (the U.S. Army's free-to-play game) reportedly used port 4 in some configurations
• Sporadic reports of null TCP packets from Android devices to port 4, with no identified purpose
• No confirmed trojans or widespread malware associated with this port

How to Check What's Listening on Port 4

If you see traffic on port 4 and want to know what's generating it:

# macOS / Linux — check for listeners on port 4
sudo lsof -i :4

# Linux — using ss
sudo ss -tlnp | grep ':4 '

# Windows — using netstat
netstat -ano | findstr :4

# Scan a remote host
nmap -p 4 <target-ip>

Because port 4 has no assigned service, anything you find listening there is either a custom application, a misconfiguration, or something worth investigating.

Why Unassigned Ports Matter

Unassigned ports in the well-known range are not wasted space. They are capacity. The Internet's port system has 65,535 addresses per transport protocol, and the well-known range has only 1,024. Leaving some unassigned means there is room for future protocols that earn the privilege of a system port.

Port 4 is a reminder that not every door needs to be open to matter. Sometimes the most interesting thing about a port is what it's waiting for.