Port 55: ISI-GL — The Graphics Protocol That Time Forgot

Port 55 is assigned to ISI Graphics Language (ISI-GL), a protocol for transmitting graphical display commands and vector-based images across networked computer systems.¹ It operates over both TCP and UDP. You will almost certainly never encounter it in the wild.

What ISI-GL Was

ISI-GL originated at the Information Sciences Institute (ISI) at the University of Southern California, one of the most consequential research labs in the history of computing.² ISI helped conceive, design, and implement the Internet itself. The lab's contributions include the Domain Name System (DNS on port 53, just two doors down in the port registry), foundational Internet protocols, the first real-time visual flight simulator on a general-purpose computer, and pioneering work in packet video that led to modern video conferencing.

ISI-GL was designed for remote visualization and interactive computing in the early stages of networked graphics. It enabled rendering commands and image data to be transferred between systems, the kind of thing researchers needed when computing power lived in one building and the display terminal lived in another.

The Protocol That Never Got Written Down

Here is the remarkable thing about port 55: it has an official IANA assignment, but no RFC.³ No formal specification document has ever been published for ISI-GL. The protocol appears in Jon Postel and Joyce Reynolds' RFC 1700 (Assigned Numbers, October 1994) with just two lines:

isi-gl    55/tcp    ISI Graphics Language
isi-gl    55/udp    ISI Graphics Language

No contact person is listed, unlike neighboring entries.¹ Port 53 credits Paul Mockapetris. Port 54 credits Susie Armstrong. Port 57 credits Jon Postel himself. Port 55 credits nobody.

This suggests ISI-GL was an internal experiment that got a port reservation during the era when ISI was IANA (the Internet Assigned Numbers Authority operated out of ISI, largely under Jon Postel's stewardship). Getting a port number assigned was less a formal process and more a matter of walking down the hall.

The Neighborhood

Port 55 sits in remarkable company. The ports around it read like a who's who of early Internet infrastructure:

ISI-GL is surrounded by protocols that either became essential or disappeared entirely. It took the second path.

Security

Port 55 has been flagged in some security databases as a port historically used by malware for communication.⁴ This is not because the ISI-GL protocol is dangerous. It is because malware authors sometimes choose obscure, rarely-monitored ports precisely because they are unlikely to be in use. An unassigned or forgotten port makes excellent cover.

If you see traffic on port 55 on your network, it is almost certainly not ISI-GL. Investigate it.

How to Check What Is Listening on Port 55

Linux:

sudo ss -tlnp | grep :55
sudo netstat -tlnp | grep :55

macOS:

sudo lsof -i :55

Windows:

netstat -an | findstr :55

If anything is listening on port 55, it deserves your attention. No legitimate modern software uses this port.

Why Unassigned Ports Matter

Port 55 occupies an interesting position: it is technically assigned (to ISI-GL), but functionally unassigned since no living software implements the protocol. This makes it part of a larger category of well-known ports (0 through 1023) that exist in the IANA registry as historical artifacts.⁵

These ports matter because the well-known range carries special significance. On most operating systems, binding to a port below 1024 requires elevated privileges. This was a deliberate security decision: the services on these ports (HTTP, SSH, DNS, SMTP) are critical infrastructure, and only trusted processes should be able to impersonate them. Port 55 inherits that protection even though the service it was reserved for no longer exists.

The port registry is a historical document as much as a technical one. Every entry tells you something about what people were building and what they thought mattered. Port 55 tells you that in the early days of networked computing, someone at ISI thought remote graphics mattered enough to reserve a port. They were right about the idea, even if ISI-GL was not the protocol that survived to carry it. That job eventually went to X11 (ports 6000-6063), VNC (port 5900), and RDP (port 3389).