Port 81: HOSTS2-NS — The Forgotten Neighbor

Port 81 sits one number away from port 80, the most famous port on the Internet. It is officially assigned to something called HOSTS2 Name Server. Nobody knows what that means anymore.

What Port 81 Is Supposed to Be

According to the IANA Service Name and Transport Protocol Port Number Registry, port 81 is assigned to hosts2-ns, the HOSTS2 Name Server protocol, for both TCP and UDP.¹ The assignment dates back to the early 1980s, when Jon Postel personally managed port number allocations from his desk at USC's Information Sciences Institute.

The contact listed for this assignment is Earl Killian, reachable at an email address on the domain MORDOR.S1.GOV.² That domain belonged to the S-1 supercomputer project at Lawrence Livermore National Laboratory, an effort to build a family of multiprocessor supercomputers that began in 1975.³

Here is the remarkable part: Earl Killian has told researchers that he doesn't know what port 81 is, or whether it's still in use.⁴ The person whose name is on the assignment does not know what the assignment is for. And Jon Postel, the only other person who might have remembered why he wrote "HOSTS2 Name Server" next to the number 81, died on October 16, 1998.⁵

Port 81 is an orphan. Officially assigned, functionally forgotten.

What Port 81 Actually Does Today

In practice, port 81 has become HTTP's understudy. When port 80 is already occupied, port 81 is the first number most people reach for.

Secondary web servers. The most common use of port 81 is running a second HTTP server on a machine where port 80 is already taken. A typical scenario: IIS runs on port 80, Apache runs on port 81, and both serve different sites from the same box. You access it by adding :81 to the URL: http://example.com:81/.

IP camera administration. Many IP camera systems default to port 80 for their web interface. When you have multiple cameras on one network and need to forward each to a different port, camera two almost always gets port 81, camera three gets 82, and so on.⁶

Development and testing. Developers sometimes run a test version of a site on port 81 alongside the production version on port 80. The reasoning is practical: port 81 is close to 80, easy to remember, and unlikely to be probed by automated scanners that focus on common ports.

Tor and anonymous routing. The TorPark browser, an early portable Tor-based anonymization tool, used port 81 for its onion routing traffic.⁷

The Well-Known Port Range

Port 81 falls within the System Ports range (0 through 1023), also called well-known ports. These are the most restricted ports in the TCP/IP system. On Unix-like operating systems, binding to any port in this range requires root or superuser privileges.⁸

This range is managed by IANA under strict assignment procedures defined in RFC 6335. New assignments require IETF Review or IESG Approval.⁹ The fact that port 81 holds one of these privileged slots for a protocol nobody remembers is a small monument to how the Internet's early infrastructure was built: one person, one notebook, one assignment at a time.

Security

Port 81 has a modest but real security profile.

The RemoConChubo remote access Trojan (RAT) is known to use port 81 for command-and-control communication.⁴ Because port 81 is commonly associated with alternate HTTP servers, malware authors sometimes use it to disguise traffic as web activity.

The SANS Internet Storm Center tracks scanning activity on port 81, and it consistently appears in network scans because automated tools probe it as a likely alternate HTTP endpoint.¹⁰

If you are not intentionally running a service on port 81, it should be closed and filtered at your firewall. Steve Gibson's ShieldsUP! service at GRC can test whether your port 81 is visible to the outside world.¹¹

How to Check What Is Listening on Port 81

macOS / Linux:

sudo lsof -i :81

or

sudo ss -tlnp | grep :81

Windows:

netstat -ano | findstr :81

If something is listening on port 81 and you did not put it there, investigate immediately.

Related Ports