Port 519: utime — The Forgotten Time Protocol

Port 519 sits in the well-known port range (0-1023), officially assigned by IANA to a service called "utime" or "unixtime."¹ But if you've never heard of it, you're not alone. This protocol is a ghost—officially registered, rarely used, largely forgotten.

What Port 519 Was For

The utime service on port 519 was designed for Unix time synchronization—a way for systems to exchange time information across a network. Before the Network Time Protocol (NTP) became the standard, various Unix-based time services existed, each with different approaches to solving the same problem: keeping clocks in sync.

Port 519 was one of those early attempts. It carries both TCP and UDP traffic for time synchronization purposes.²

Why Nobody Uses It Anymore

The Internet standardized on better solutions. The Time Protocol (RFC 868) uses port 37 and provides a simple 32-bit timestamp.³ The Network Time Protocol (NTP) uses port 123 and offers sophisticated clock synchronization with microsecond precision.⁴ Between these two standards, there's little reason for utime to exist.

But port 519 remains officially assigned. IANA doesn't casually de-register well-known ports. The reservation persists even when the protocol fades into obscurity.

The Well-Known Range

Ports 0-1023 are called "well-known ports" or "system ports." These are assigned by IANA through formal processes—IETF Review or IESG Approval as described in RFC 6335.⁵ Getting a port in this range requires documentation, justification, and standards track approval.

Port 519 earned that reservation decades ago. It sits among protocols that power the Internet (SSH, HTTP, DNS) and protocols that nobody remembers (utime, chargen, daytime). The well-known range is both a directory of essential services and a museum of abandoned ideas.

Security Considerations

Abandoned doesn't mean harmless. Security databases have flagged port 519 in connection with malware and trojans.⁶ When a port has no legitimate active use, any traffic on it becomes suspicious. If something is listening on port 519, it's either a legacy system running ancient software or something pretending to be one.

Check what's listening:

# Linux/macOS
sudo lsof -i :519
sudo netstat -tulpn | grep :519

# Windows
netstat -ano | findstr :519

If you find something listening on port 519 and you didn't intentionally configure a time service there, investigate it.

Why Unassigned and Forgotten Ports Matter

The port number system (0-65535) is a finite resource. Every reserved port is one less available number. When protocols become obsolete but keep their reservations, they create dead zones in the addressing space—numbers that can't be reused but serve no active purpose.

Port 519 represents a particular kind of Internet archaeology: not unassigned, not actively used, just... reserved. A placeholder for a protocol that once mattered enough to earn a well-known port number but not enough to survive the evolution of better standards.

The Internet remembers everything, even the things it's forgotten.

Related Ports

• Port 37 — Time Protocol (RFC 868), the simpler standardized alternative
• Port 123 — NTP (Network Time Protocol), the sophisticated modern standard
• Port 520 — Extended File Name Server (EFS), another mostly-forgotten well-known port