Port 1789: Unassigned — The Port That Belongs to No One (and Possibly Check Point)

Port 1789 belongs to the registered port range (1024–49151). These ports require IANA registration to be officially assigned to a service, but IANA has not assigned port 1789 to anything. It has no official owner, no RFC, no service name in the registry.¹

That doesn't mean it's quiet.

What Actually Uses This Port

In practice, port 1789 appears in network traffic associated with Check Point firewall administration — specifically communication between Check Point Security Gateways and their management servers.²³ This is unofficial use: Check Point never registered the port with IANA, and it isn't listed in their primary documentation as a required port.

That pattern is common in enterprise security software. Products claim ports they need, and IANA registration is an afterthought — or never happens at all.

Beyond Check Point, port 1789 doesn't have a strong association with any particular software or protocol in the wild. It appears occasionally in security research port surveys, but without a dominant service fingerprint.⁴

What the Registered Range Means

The registered range (1024–49151) sits between the well-known ports (0–1023, which require root/admin to open and are tightly controlled) and the ephemeral ports (49152–65535, which operating systems hand out dynamically for outbound connections).

Registered ports are supposed to be claimed through IANA. In reality, thousands of them are used informally — by enterprise software, internal tools, or applications that never bothered to file the paperwork. An unassigned port in this range isn't a gap; it's unclaimed territory.

What to Do If You See It

If port 1789 shows up in your network traffic or on a listening service list, the most likely explanation is Check Point firewall administration traffic. But verify:

On Linux/macOS:

# See what process is listening on port 1789
sudo ss -tlnp | grep 1789
# or
sudo lsof -i :1789

On Windows:

netstat -ano | findstr :1789

With nmap:

nmap -sV -p 1789 <target>

If nothing on your network runs Check Point, and you're seeing traffic on port 1789, investigate it. Unusual traffic on unassigned ports is a classic signal worth following.

The Number

Port 1789 shares its number with the year the Bastille fell — the start of the French Revolution, and also the year the United States Constitution took effect.⁵ Whether the Check Point engineers who use this port noticed the coincidence is lost to history. But port numbers are chosen by humans, and humans notice these things.