Port 752: Unassigned — A deprecated well-known port

Port 752 sits in the well-known port range (0-1023), but it doesn't belong to anyone anymore.

The Range That Matters

The well-known port range (0-1023) is reserved for system services and protocols assigned by the Internet Assigned Numbers Authority (IANA). These ports require root or administrator privileges to use on most operating systems—they're the foundation of Internet infrastructure.

But not every port in this range has an assignment. Some were never assigned. Others, like port 752, had assignments that were later removed.

What Happened to Port 752

Port 752 was once assigned to QRH (Query Response Handler) for both TCP and UDP. On May 18, 2017, IANA removed this assignment from the official registry.¹ The protocol is no longer maintained, and the port number was effectively deprecated.

This is rare but not unprecedented. As protocols evolve, some become obsolete. When a service is no longer used and no one requests to maintain the assignment, IANA can remove it.

The Unofficial Use

You might occasionally find port 752 referenced in connection with Kerberos password changes (kpasswd). Some older documentation lists it as an unofficial alternative for the Kerberos password service.²

But here's the important part: the official port for Kerberos password changes is 464, not 752.³ Modern Kerberos implementations use port 464. If you see traffic on port 752 claiming to be kpasswd, it's either:

• A legacy system that hasn't been updated
• A misconfiguration
• Something pretending to be what it's not

Why Unassigned Ports Matter

Unassigned well-known ports are unusual. The well-known range is valuable real estate—each port number can only belong to one official service. Having gaps in this range means:

1. Historical change is visible — You can see where protocols were deprecated
2. Room for future assignment — Though rare, IANA could assign port 752 to a new service
3. Potential security implications — Unassigned ports in the well-known range might be exploited by malicious services pretending to be legitimate

Checking What's Listening

If you want to see if anything is actually using port 752 on your system:

On Linux or macOS:

# See what's listening on port 752
sudo lsof -i :752

# Or use netstat
sudo netstat -tulpn | grep :752

On Windows:

# See what's listening on port 752
netstat -ano | findstr :752

If something is listening on port 752, you should know what it is and why it's there. In the well-known range, unknown services are worth investigating.

The Takeaway

Port 752 is a ghost in the well-known range. It had official recognition, lost it, and now exists as an empty slot where something used to be.

The Internet evolves. Protocols that seemed permanent get deprecated. Services move to different ports. What was once essential becomes obsolete.

Port 752 is a reminder: even in infrastructure, nothing lasts forever.