Port 430: UTMPSD — The Ghost in the Login Records

Port 430 sits in the well-known ports range (0-1023), officially assigned by IANA to UTMPSD for both TCP and UDP.¹ But ask anyone what UTMPSD does, and you'll get blank stares. Even the documentation has mostly vanished.

What UTMPSD Is (Probably)

UTMPSD appears to be a network service related to Unix's utmp login accounting system. On Unix and Linux systems, the utmp, wtmp, and btmp files have tracked user logins since the very beginning—who logged in, when, from which terminal, and when they logged out.²

The utmp system itself dates back to Version 1 of AT&T UNIX in 1971—older than email, older than TCP/IP, older than almost everything on the Internet.³ It's the reason commands like who and last work. It's how the system knows who's currently logged in.

At some point, someone decided this login accounting needed to work over a network. That's where UTMPSD comes in—a daemon (the 'd' suffix) that would handle utmp operations remotely. But unlike utmpd, which monitors local utmp files on systems like Solaris and HP-UX,⁴ UTMPSD was designed as a network service.

The Mystery

Here's the strange part: there's almost no documentation about UTMPSD actually being used. No RFC. No manual pages. No war stories from sysadmins who ran it in production. The service name appears in IANA's registry and in port databases, but the actual daemon seems to have evaporated.

Either UTMPSD was:

• An experimental service that never saw wide adoption
• A vendor-specific tool that died with its platform
• So successful it was replaced by better alternatives before anyone documented it

What This Port Means Now

Port 430 is assigned but essentially unused. You won't find UTMPSD running on modern systems. Login accounting happens locally now, or through centralized authentication systems like LDAP and Kerberos that handle it differently.

Some security databases flag port 430 as having been exploited by malware in the past,⁵ which makes sense—an obscure, forgotten service on a well-known port makes an excellent hiding place.

Checking What's Listening

On Linux or macOS:

sudo lsof -i :430
sudo netstat -tuln | grep :430

On Windows:

netstat -ano | findstr :430

If something's listening on port 430, it's probably not UTMPSD. Modern systems don't use it. Investigate immediately.

Why Unassigned Ports Matter

Port 430 isn't technically unassigned—it has an official IANA registration.¹ But it's effectively unassigned because the service it was meant for has disappeared.

This is common in the well-known ports range. Many assignments date back decades to services that made sense in the 1980s and 1990s but have since been replaced or forgotten. The port numbers remain assigned because the IANA registry is permanent—once a port gets an official assignment, it stays that way.

The well-known range (0-1023) was supposed to be sacred space for fundamental Internet services. But time moves on, and some of these ports have become archaeological artifacts—reminders of problems people used to have and solutions that once seemed important enough to deserve a dedicated port.

Port 430 is one of those ghosts. The login accounting system it was built for still exists and still matters. But UTMPSD itself? It vanished, leaving only a number behind.