Port 44: MPM FLAGS — The Messaging Protocol That Time Forgot

Port 44 is assigned to the MPM FLAGS Protocol, part of a messaging system designed by Jon Postel in 1980 to route messages across the early Internet.¹ If you've never heard of it, that's because almost nobody has used it in decades. But the port assignment is still there, a reservation that was never cancelled.

What the MPM FLAGS Protocol Was

MPM stands for Message Processing Module. It was the core process in Postel's Internet Message Protocol, defined in RFC 759.¹ The idea was straightforward: users compose messages through a User Interface Program, and the MPM handles routing those messages to their destination, whether that's another user on the same host, a different host on the same network, or a user on an entirely different network.

The MPM examined outgoing messages, consulted routing tables, and figured out which link to use. When acting as a relay, it stamped each message with a record of every MPM that had handled it, creating a trail. Think of it as an early, experimental ancestor of the email routing systems we use today.

Port 44 specifically handled the flags portion of this protocol. It was part of a trio:

• Port 44 (mpm-flags): MPM FLAGS Protocol
• Port 45 (mpm): Message Processing Module [recv]
• Port 46 (mpm-snd): MPM [default send]

Three ports for one messaging system: one for control flags, one for receiving, one for sending.²

The History

Jon Postel wrote RFC 759 in August 1980 at USC's Information Sciences Institute, as part of the ARPA-sponsored Internetwork Concepts Research Project.¹ It was the second edition of the specification (the first was RFC 753, from March 1979).³

The Internet Message Protocol was experimental. It was one of several competing approaches to solving the problem of sending messages between different networks. The MPM architecture was elegant: it separated the user interface from the routing logic, it supported relay chains across networks, and it tracked message provenance through stamps and trails.

But history chose differently. SMTP, defined in RFC 821 in 1982, became the standard for email.⁴ The MPM-based Internet Message Protocol faded into the background, joining the long list of protocols that shaped the thinking behind what we use today without surviving themselves.

Security

Port 44 has been flagged in some security databases as having been used by trojans in the past for command-and-control communication.⁵ This is not unusual for low-numbered ports with little legitimate modern traffic. An attacker using port 44 is betting that no one is watching a port that no one uses.

If port 44 is open on your system and you're not running anything that needs it, close it.

How to Check What's Listening on Port 44

# macOS / Linux
sudo lsof -i :44
netstat -an | grep ':44 '

# Windows
netstat -an | findstr ":44"

If something is listening on port 44, investigate it. There is no common modern software that needs this port.

Why This Port Matters

Port 44 is a reminder that the Internet's port system carries history. IANA's registry is not just a list of active services. It's a record of every idea that was important enough to get a reservation, whether or not it survived.

Jon Postel assigned three consecutive ports to a messaging protocol that imagined how the Internet would communicate. That protocol didn't win, but the ideas inside it — message routing tables, relay chains, provenance tracking — live on in every email system running today. The architecture of SMTP owes a debt to the thinking that went into the MPM.

Port 44 is a well-known port (range 0-1023), which means it was assigned by IANA and typically requires root or system-level privileges to bind to.² It sits in the oldest neighborhood of the port system, among the protocols that were there when the Internet was still being invented.