Port 411: Remote MT Protocol — The Tape Drive Port That Became a File Sharing Hub

Port 411 sits in the well-known port range (0-1023) and has an official IANA assignment. But like many ports in this range, what it was assigned for and what it actually got used for are two different stories.

What Port 411 Was Assigned For

According to IANA's official registry, port 411 is assigned to Remote MT Protocol (rmt), registered by Peter Eriksson.¹ Both TCP and UDP.

Remote MT Protocol is exactly what it sounds like: a protocol for accessing magnetic tape drives over a network. In Unix and Linux systems, the rmt program allowed tools like tar, dump, and restore to operate on tape drives connected to remote machines.² You'd back up your data to a tape drive that wasn't physically attached to your computer.

This made sense in the 1980s and early 1990s when magnetic tape was the primary medium for backups and long-term storage. The protocol used simple commands sent over the network to control the tape drive: read, write, seek, rewind.

That world is gone. Tape drives still exist in enterprise settings, but remote tape access over port 411 is essentially extinct. The protocol is a fossil.

What Port 411 Actually Got Used For

In November 1999, a high school student named Jon Hess created Direct Connect, a peer-to-peer file sharing protocol.³ Direct Connect worked differently than other P2P systems of that era. Instead of a fully distributed network, it used a hub-and-spoke model: clients connected to a central hub, which acted as a directory and meeting point. The hub didn't host files, it just introduced clients to each other so they could transfer files directly.

Direct Connect hubs commonly used port 411.⁴ Thousands of hubs ran on this port during the early 2000s file sharing boom. The hub would listen on port 411, clients would connect, search for files, chat, and initiate direct transfers to other clients.

Direct Connect never officially owned port 411. It just moved in. IANA's registry still says "Remote MT Protocol." The actual traffic was teenagers sharing music and movies.

Why This Matters

Port 411 illustrates something important about how the Internet actually works versus how it's supposed to work. IANA assigns ports. Organizations register them. But enforcement is impossible. If your application listens on a port and people use it, that's what the port does, regardless of what the registry says.

The well-known port range (0-1023) was supposed to be carefully managed, with assignments only for important, standardized protocols. Port 411 got assigned to magnetic tape access, which seemed important in 1985. By 2000, that protocol was irrelevant, and the port number was just sitting there, available for anyone who wanted it.

Direct Connect chose it. Maybe deliberately, maybe randomly. The choice stuck.

Current Status

Neither use case is particularly active today. Remote MT Protocol died with the magnetic tape era. Direct Connect peaked in the early-to-mid 2000s and declined as BitTorrent became dominant and streaming services emerged. Some Direct Connect hubs still exist, but the protocol is largely historical.

If you see traffic on port 411 today, it's worth investigating what's actually using it. It could be:

• A legacy Direct Connect hub
• Malware (various trojans have used port 411)⁵
• Some other application that picked the port arbitrarily
• Actual Remote MT Protocol traffic (extremely unlikely)

Check what's listening:

# Linux/Mac
sudo lsof -i :411
sudo netstat -tulpn | grep :411

# Windows
netstat -ano | findstr :411

The Real Story

Port 411 is a historical marker. It points to two different eras of networking: the Unix tape backup era and the early P2P file sharing era. Both are mostly over. The port remains, officially assigned to a dead protocol, unofficially associated with a dying one, and actually used for almost nothing.

This is normal. The port number registry is not a source of truth about what's running on the Internet. It's a map of intentions. The territory is different.