Port 401: UPS — The Port That Was Never Used

Port 401 is a ghost port. Officially assigned, formally registered, and completely unused.

The Assignment That Went Nowhere

On August 29, 2008, the Internet Assigned Numbers Authority (IANA) assigned port 401 to Charles Bennett for "Uninterruptible Power Supply" (UPS) management.¹ The assignment covered both TCP and UDP protocols. It appeared in the official registry. It had a contact email at Ohio University.

And then nothing happened.

No RFC was published. No protocol specification appeared. No UPS manufacturers adopted it. The port sat empty while the rest of the Internet's power management infrastructure developed around different standards entirely.²

Charles Bennett died in 2015. The port assignment outlived him.

What Actually Handles UPS Management

Real UPS network management doesn't use port 401. It never has.

The protocol that actually works — the one with an RFC, deployment, and users — is defined in RFC 9271.³ It uses port 3493/TCP and has been operating since May 2002 under the name Network UPS Tools (NUT).

For SNMP-based monitoring, UPS devices use RFC 1628's UPS MIB (Management Information Base), which runs over standard SNMP ports (161/162).⁴

Port 401 was supposed to be for UPS management. But UPS management happened elsewhere, on ports that actually got built.

The Only Thing That Ever Used Port 401

One Windows trojan, once, reportedly used port 401 for communications.⁵ That's the only documented use in the port's entire history.

Not UPS monitoring. Not power management. Malware, briefly, because empty ports are convenient for things that don't want to be noticed.

What Happens to Ghost Ports

Port 401 sits in the well-known port range (0-1023), the space reserved for system services and standardized protocols. These ports are supposed to be managed carefully because they represent foundational Internet infrastructure.

But port 401 has no protocol, no active assignee, and no documented legitimate use. The Network UPS Tools project requested transfer of the port assignment in 2015.⁶ Whether that transfer happened or the port remains assigned to a deceased person's Ohio University email address is unclear.

What is clear: port 401 represents something that was planned but never built, registered but never realized.

Checking Port 401

To see if anything is listening on port 401 on your system:

Linux/macOS:

sudo lsof -i :401
sudo netstat -tulpn | grep :401

Windows:

netstat -ano | findstr :401

You probably won't find anything. Nobody uses this port.

The Honest Truth About Unassigned Space

Port 401 isn't technically unassigned — it has an official registry entry. But functionally, it's empty. Reserved but unused. Claimed but abandoned.

The well-known port range contains hundreds of assignments like this: ports registered to services that never launched, protocols that were superseded before deployment, or assignments that became obsolete as technology moved on.

Port 401 is a reminder that the port number registry is not just a technical document — it's archaeology. You can see the intentions, the plans, the moments when someone thought "we're going to build this" and filed the paperwork.

Sometimes the thing gets built. Sometimes it doesn't. Either way, the port number remains, a fossil of what someone once hoped the Internet would carry.