Port 472 sits in the well-known port range (0-1023), officially assigned by IANA to a protocol called ljk-login. Both TCP and UDP. Registered by LJK Software of Newton, Massachusetts.12
But ask what ljk-login actually does, and the Internet goes quiet.
What We Know
The assignment exists. Port 472, TCP and UDP, ljk-login. The company that registered it—LJK Software—still exists as a prepackaged software provider.3 Founded in 1991, located in Newton Upper Falls, owned by Larry J Kilgallen.
The protocol name suggests authentication. "Login" is right there in the name. Probably a proprietary authentication system. Something LJK Software built for their clients in the early networking days.
But the documentation is gone. The RFCs don't mention it. The protocol specifications aren't publicly available. The Internet has moved on.
The Well-Known Port Range
Port 472 lives in the well-known port range (0-1023), which means it was assigned by IANA for a specific service.4 These ports are supposed to be reserved for standardized, widely-used protocols. HTTP gets 80. HTTPS gets 443. SSH gets 22.
And ljk-login gets 472.
Being in this range means someone believed, at the time of registration, that this protocol would matter. That it would be used widely enough to deserve a permanent, reserved spot in the port numbering system.
History had other plans.
Security Warnings
Search for port 472 today and you'll find security sites flagging it. Not because ljk-login is dangerous, but because old trojans used this port.12 When a port falls into disuse, malware sometimes squats there. The legitimate service is gone, the port is open, and attackers move in.
This doesn't mean port 472 is inherently dangerous. It means the protocol that was supposed to protect it has faded away.
Checking What's Listening
If you want to see if anything is using port 472 on your system:
On Linux/Mac:
On Windows:
Most likely, you'll find nothing. Port 472 is probably silent on your machine. A reserved address for a protocol that no one uses anymore.
Why Unassigned Ports Matter
Port 472 isn't technically unassigned—it has a registered service name. But functionally, it's orphaned. The protocol exists in name only.
These ghost ports matter because they show the evolution of the Internet. In the early days, anyone building a networked service could register a port number. Some of those services became foundational (SMTP, FTP, DNS). Others faded into obscurity.
The port registry is an archaeological record. Every number tells a story about what someone thought was important enough to deserve a permanent address on the Internet.
Port 472 is one of those stories. We don't know the ending anymore. We just know it mattered once.
The Honest Reality
If you see traffic on port 472, it's probably not ljk-login. It might be:
- A trojan using an abandoned port for command and control
- A custom internal application that repurposed the port number
- A misconfiguration somewhere in your network
The official assignment remains, but the protocol has vanished. LJK Software moved on to other things. The Internet evolved. And port 472 became a ghost—a name in a registry, a number that once meant something specific, now just an empty room in the vast architecture of TCP/IP.
Was this page helpful?