What Port 440 Is
Port 440 is officially assigned to SGCP (Simple Gateway Control Protocol)1, a Voice over IP (VoIP) protocol that existed for exactly four months in 1998 before being superseded. It sits in the well-known ports range (0-1023), which means it was assigned by IANA under IETF review procedures.
You will almost never encounter legitimate traffic on this port. The protocol it was designed for no longer exists.
The Protocol That Wasn't
SGCP was published between May and July 1998 by Mauricio Arango and Christian Huitema at Telcordia Technologies (formerly Bellcore)2. It was designed to control media gateways in VoIP systems—the devices that bridge traditional phone networks (PSTN) and IP networks.
The architecture was sound: a central "Call Agent" would control multiple media gateways, handling the signaling while the gateways converted voice between analog phone lines and digital packets.
But SGCP never made it to RFC status. By October 1998—four months after its first draft—it had merged with Level 3 Communications' IPDC (Internet Protocol Device Control) proposal to create MGCP (Media Gateway Control Protocol)3.
MGCP became RFC 2705. SGCP became a footnote. Port 440 became an assignment to a protocol that no longer existed.
What Actually Uses Port 440
Not SGCP. The protocol died before most networks heard of it.
Instead, port 440 has been flagged in security databases because trojans and malware have used it for command and control communication4. When you see port 440 listening on a system, it's more likely to be malware than legacy VoIP infrastructure.
This doesn't mean every use of port 440 is malicious—but the historical pattern is there. A trojan used this port in the past. The port got flagged. The legitimate service never materialized.
How to Check What's Listening
On Linux or macOS:
On Windows:
If you see something listening on port 440, investigate it. It should not be there unless you explicitly configured something unusual.
Why This Port Matters
Port 440 is a reminder that the Internet's numbering system contains ghosts. Protocols that were assigned ports and then vanished. Services that merged into other services. Numbers reserved for things that never shipped.
SGCP lived for four months. Its successor MGCP moved to UDP port 24275. Port 440 stayed in the registry, assigned to a protocol that doesn't exist, occasionally borrowed by malware looking for an unused door.
The well-known ports range (0-1023) was supposed to be for established, important services. Port 440 got reserved for something that became obsolete before it became established. And then the trojans found it convenient.
Related Ports
- Port 2427 (UDP) - MGCP (Media Gateway Control Protocol), the successor to SGCP that actually survived
- Port 2727 (TCP/UDP) - MGCP Gateway (alternate MGCP port)
- Port 5060 (TCP/UDP) - SIP (Session Initiation Protocol), the VoIP signaling protocol that eventually dominated
Frequently Asked Questions
Was this page helpful?