Port 78: vettcp — A Reservation Without a Story

What Port 78 Does

Nothing, as far as anyone can tell.

Port 78 is registered in the IANA Service Name and Transport Protocol Port Number Registry¹ under the service name "vettcp" for both TCP and UDP. The contact listed is Christopher Leong. No RFC was ever published for it. No public documentation describes what "vettcp" was supposed to do. No widely used software listens on this port.

If you scanned every server on the Internet right now, port 78 would almost certainly be closed or filtered on every single one.

The Well-Known Range

Port 78 falls within the well-known port range (0 through 1023)². These are the reserved seats of the Internet. They are assigned by IANA, and on most operating systems, only privileged processes (running as root or administrator) can bind to them. The well-known range houses the protocols that built the Internet: HTTP on 80, SSH on 22, DNS on 53, SMTP on 25.

Port 78 has a seat at this table but has never used it.

What "vettcp" Means

Nobody knows, publicly. The name appears in port registries across the Internet, always with the same sparse entry: port 78, service name "vettcp," TCP and UDP, no RFC³. Some registries expand it to "Vetted TCP," but this appears to be speculation rather than an official expansion. The protocol has left no footprint in open-source code, network analysis tools, or academic literature.

It is possible that "vettcp" was an internal protocol at a company or institution, registered with IANA to avoid port conflicts, and never released publicly. This was more common in the early days of port registration, when the process was less formal and the well-known range was not yet scarce.

Security

Port 78 has been flagged by some security databases as historically associated with trojan activity⁴. This is not unique to port 78. Malware authors sometimes choose obscure, unassigned ports precisely because they are unlikely to be monitored. An open port 78 on a system that has no reason to use it is worth investigating.

How to Check What Is Listening on Port 78

Linux/macOS:

sudo lsof -i :78
sudo ss -tlnp | grep :78

Windows:

netstat -ano | findstr :78

Remote scan with nmap:

nmap -p 78 target_host

If something is listening on port 78 and you did not put it there, find out what process owns it. On a healthy system, nothing should be.

Why Unassigned Ports Matter

The port number space has 65,535 entries. Only a fraction are assigned to specific protocols. The unassigned ones are not wasted space. They are available for private use, internal services, development servers, and ephemeral connections. Some of the most interesting software on any given network runs on ports that have no official name.

But unassigned well-known ports like 78 occupy an unusual position: reserved enough that most software avoids them, obscure enough that most firewalls ignore them. They exist in a blind spot, which is exactly why they deserve attention.