Port 659: Removed — A Ghost in the Well-Known Range

Port 659 occupies an unusual position in the port system. It sits in the well-known range (0-1023), the space reserved for fundamental Internet services assigned by IANA. But it carries nothing. It was officially removed from the registry on June 6, 2001.[^1]

Most ports either stay assigned forever or remain unassigned waiting for someone to claim them. Port 659 did something different—it was given a purpose, then had that purpose revoked.

What the Well-Known Range Means

Ports 0-1023 are the well-known ports, assigned by the Internet Assigned Numbers Authority (IANA) for essential services. HTTP lives at 80. HTTPS at 443. SSH at 22. These assignments are meant to be permanent—carved into the foundation of the Internet's addressing system.[^2]

Getting a well-known port requires convincing IANA that your protocol is important enough to deserve a permanent, privileged address. Giving one back is rare.

What Port 659 Was

Before its removal, port 659 appears to have been associated with URL Rendezvous Directory (URD) for Source Specific Multicast (SSM)—a system for managing multicast group membership.[^3] Some historical references also mention its use with Mac OS X RPC-based services like NetInfo.[^4]

But the official record shows only one thing clearly: removed, 2001-06-06.[^1]

Why Ports Get Removed

Ports are removed when:

• The protocol they supported became obsolete
• The service moved to a different port
• The assignment was made in error
• The organization maintaining the protocol stopped supporting it

Whatever port 659's story was, it ended more than two decades ago.

What Listens Here Now

Nothing official. But "removed" doesn't mean "unused." The port number still exists. Systems can still bind to it. Software can still try to connect.

To check what's listening on port 659 on your system:

Linux/Mac:

sudo lsof -i :659
sudo netstat -tulpn | grep :659

Windows:

netstat -ano | findstr :659

If something appears, it's either:

• Legacy software that used the port before it was removed
• Software using it unofficially because the number was available
• Malware (port 659 has been associated with some trojans historically)[^4]

Why Unassigned Ports Matter

Port 659 demonstrates something important about the port system: assignments aren't always permanent. The Internet evolves. Protocols die. Numbers get recycled or abandoned.

The well-known range isn't as immutable as it seems. Even in the foundation, things change.

If you see traffic on port 659, investigate it. There's no legitimate service that should be there anymore. Anything using it is either very old or very suspicious.