Port 1915: FACELINK — A Registered Ghost

What This Port Is

Port 1915 sits in the registered port range (1024–49151). These are ports that applications and services can claim through IANA — the Internet Assigned Numbers Authority — to stake out territory for their protocol.

IANA's registry lists port 1915 as assigned to a service called FACELINK, registered under the name J.H. Hermans, on both TCP and UDP. That's where the paper trail ends.¹

There is no RFC for FACELINK. No open-source implementation. No documentation. No forum posts from users troubleshooting it. FACELINK appears to be a registered ghost — a name in a database, nothing more.

What the Registered Port Range Means

Registration doesn't mean adoption. Anyone can apply to register a port with IANA, and IANA will assign it if the range is available. Registration is a claim, not a deployment.

The registered port range contains thousands of entries like this: protocols that were assigned numbers in anticipation of software that never shipped, services that launched and died before the Internet was large enough to remember them, and internal tools that were registered out of caution but never exposed publicly.

Port 1915 is one of them.

What Might Actually Be on Port 1915

If you see traffic on port 1915 on a real network, it isn't FACELINK. It's almost certainly:

• Application-specific traffic — Some software picks ports from the registered range arbitrarily, especially for internal communication between local processes or services
• Developer tools — Local development servers and debugging proxies sometimes land here
• Malware — Some malicious software uses obscure registered ports to blend into normal traffic patterns²

The port's registered status provides no protection. IANA registration isn't a firewall.

How to Check What's Listening

To see if anything is using port 1915 on your system:

macOS / Linux:

lsof -i :1915

Windows:

netstat -ano | findstr :1915

If something shows up, the process ID will tell you what application it is. An open port you didn't put there is worth investigating.