Port 6: Unassigned — The Empty Chair at the Oldest Table

Port 6 is unassigned. No protocol runs here by default. No RFC defines a service for it. No standard expects traffic on it.

This makes port 6 one of the quiet gaps in the well-known port range (0 through 1023), the most privileged neighborhood in the Internet's addressing system. It sits between port 5 (Remote Job Entry) and port 7 (Echo), two protocols that trace back to the earliest days of networked computing. Port 6 has been empty the entire time.

What "Unassigned" Means

The Internet Assigned Numbers Authority (IANA) maintains the official registry of port numbers and their associated services.¹ Ports in the well-known range (0 through 1023) require formal approval through IETF Review or IESG Approval before a protocol can claim one.²

Port 6 has never gone through that process. It is listed as "Unassigned" for both TCP and UDP in the IANA registry. This is distinct from "Reserved," which means IANA has set a port aside for a specific purpose. Unassigned means the port is available for assignment but no one has ever requested it.

The Neighborhood

The first ten ports tell a story about what mattered when networked computing was young:

Several of these early ports were never filled. The numbering system was established with room to grow, and not every slot found a protocol. Ports 2 and 3 were recently de-assigned, their original protocol (CompressNet) having long since faded from use.¹ Port 6 never had anything to lose.

Why Unassigned Ports Matter

Gaps in the well-known range serve a purpose. They represent capacity held in reserve for future protocols that may need the elevated trust of a system port. On Unix-like operating systems, binding to any port below 1024 requires root or administrative privileges.³ This restriction exists so that unprivileged users cannot impersonate critical system services. An unassigned well-known port carries that same privilege requirement, which means it cannot be casually co-opted.

Unassigned ports also function as signals. If you see traffic on port 6 during a network scan, something unusual is happening. No legitimate, standardized service should be listening there. This makes unexpected activity on unassigned well-known ports worth investigating.

Security Considerations

Port 6 does not appear in common trojan port databases, and no widely documented malware uses it as a default command-and-control channel.⁴ However, the absence of a known association does not make traffic on this port safe. Any service listening on an unassigned well-known port warrants scrutiny.

Because no standard service uses port 6, most firewalls will block or flag traffic on it by default. This is the correct behavior. If you find port 6 open on a system, the question to ask is simple: who put a service there, and why?

How to Check What Is Listening on Port 6

On Linux:

sudo ss -tlnp | grep ':6 '
sudo lsof -i :6

On macOS:

sudo lsof -i :6
sudo netstat -an | grep '\.6 '

On Windows:

netstat -ano | findstr ":6 "

If any of these commands return a result, a process is bound to port 6 on your system. Investigate it.