Port 41: Graphics — Where the Network Learned to See

Overview

Port 41 is assigned to the Graphics protocol, registered with IANA for both TCP and UDP.¹ The service name is simply graphics.

This is not an unassigned port. It is an abandoned one. Port 41 was reserved for the Network Graphics Protocol (NGP), a 1972 ARPANET-era standard for transmitting graphical display information between networked computers. The protocol was defined, implemented at a handful of sites, and then overtaken by history. No modern system uses port 41 for its intended purpose.

But the story of why it exists is worth telling.

The Problem: Every Screen Spoke a Different Language

In 1971, the ARPANET was growing. Thirty institutions were connected, from BBN and Xerox PARC to NASA's Ames Research Laboratories. And many of them had graphical display terminals: the IBM 2250, the IMLAC PDS-1, the DEC 338, the DEC 340, Tektronix storage tubes.²

The problem was that none of these devices spoke the same language. A program at MIT that could draw plots on a local display had no way to draw those same plots on a terminal at UCSB. Each graphics device had its own command set, its own coordinate system, its own way of thinking about pixels and beams and vectors.

RFC 192, published in July 1971, framed the challenge: roughly 75% of terminals on the network were simple storage tube devices, another 15-20% were basic refresh displays, and the remainder were high-performance graphics processors.³ A network graphics protocol needed to work across all of them.

The assumption, remarkable for 1971, was this: "The user of the graphics terminal should be just another timesharing system user." They wanted graphics to be as routine as text.

The Protocol: Level 0

On January 12, 1972, RFC 292 was published. Five authors from three organizations designed what they called the Network Graphics Protocol, Level 0.⁴

The authors were Jim Michener and Ed Meyer from MIT's Project MAC, Ira Cotton from MITRE, Karl Kelley from the University of Illinois, and Dave Liddle from Owens-Illinois.

Level 0 was intentionally minimal. The entire protocol consisted of eleven commands:

• Move the beam to a position
• Draw a line from the current position
• Place a dot at a location
• Display text using Network ASCII
• Escape sequences for device-specific features

All information was expressed as a sequence of 8-bit bytes. Coordinates used a two-dimensional system with fractional values in two's-complement notation, centered at the origin, ranging from -1/2 to just under +1/2.⁴

The design philosophy was stated directly: "The output is a function solely of the current command and the beam position." No state machine. No display lists. No retained mode graphics. Just draw.

They called it Level 0 because higher levels were planned. Level 1 would add structured display lists. Level 2 would add interaction and input handling. These levels were discussed in subsequent RFCs but never standardized.

What Happened

RFC 387, published in August 1972, documented actual implementation experience with NGP Level 0. Karl Kelley and Jaacov Meir reported on the ambiguities they encountered, including the fact that RFC 292 never specified whether coordinate data formats were the same in absolute and relative modes.⁵

MITRE attempted to demonstrate the protocol using the Culler-Fried system at UCSB, connecting through their Terminal Interface Message Processor to an IMLAC graphics device. The resolution was unsatisfactory. They ended up defining their own low-level graphics protocol instead.⁶

The Network Graphics Protocol never gained traction. The terminals were too different. The network was too slow. The protocol was too simple for real work and too specific for general use. By the time networks were fast enough for real graphics, the X Window System (1984) and later protocols solved the problem in fundamentally different ways.

Port 41 remained in the registry, assigned to a protocol that stopped being used before most of the Internet was born.

Security

Port 41 carries no legitimate traffic on modern networks. Any connection attempt to port 41 should be treated as suspicious, likely a port scan or probe. The port is not associated with any well-known malware or trojans, but its obscurity provides no protection. If port 41 is open on your system, something unexpected is listening.

How to Check What's Listening on Port 41

# Linux
sudo ss -tlnp | grep :41
sudo netstat -tlnp | grep :41

# macOS
sudo lsof -i :41

# Windows
netstat -an | findstr :41

If anything responds, investigate immediately. No modern software has a legitimate reason to bind to port 41.

The Range

Port 41 sits in the System Ports range (0-1023), also called well-known ports. These are assigned through IETF Review or IESG Approval as described in RFC 6335.⁷ On most operating systems, binding to a port in this range requires root or administrator privileges.

Being in the well-known range means port 41 was considered important enough to receive a permanent reservation. In 1972, that made sense. The Network Graphics Protocol was part of the vision for what the ARPANET could become: a place where you could not just send messages and transfer files, but see.

Why Abandoned Ports Matter

The IANA port registry contains many assignments like port 41: protocols designed for a specific moment in computing history, registered, and then left behind as the world moved on. These assignments are not mistakes. They are fossils.

Each one records a problem someone thought was important enough to solve at the protocol level. Port 41 records the moment the network's builders looked at their text-only terminals and thought: we need to be able to draw.

They were right. They were just early.