Port 595: CAB Protocol — The ghost in the registry

Port 595 exists in that strange space between official and forgotten. It's registered with IANA for the CAB Protocol¹, assigned to both TCP and UDP. The registration happened. The port was claimed. And then... silence.

What Port 595 Is Supposed To Do

According to IANA records, port 595 is assigned to "CAB Protocol."² That's all most documentation will tell you. No detailed RFC. No widespread implementation. No community of users discussing configuration tips or security considerations.

The protocol was registered by someone who saw a need, requested a port number, and received this address in the well-known ports range. Whatever problem CAB Protocol was meant to solve, it never became common enough for most network engineers to encounter it.

The Well-Known Ports Range

Port 595 sits in the well-known ports range (0-1023), the addresses managed most tightly by IANA. These ports are supposed to be for system services—the fundamental protocols that make the Internet work. Getting assigned a port in this range once meant submitting detailed documentation and demonstrating a legitimate need.

Port 595 got that assignment. But assignment doesn't guarantee use.

What Actually Uses This Port

In practice, almost nothing. Security scanning databases list it.³ Port reference tools acknowledge its existence.⁴ But if you scan your network right now, port 595 is probably closed everywhere. Not blocked—just unused. No service listening. No traffic flowing.

Some scanning tools have flagged port 595 for historical trojan activity, but that's true of many obscure ports—malware sometimes squats in unused addresses precisely because nobody's watching them.

Why Unused Ports Matter

The Internet's port system has 65,535 addresses in each protocol. Port 595 represents what happens when we allocate a finite resource to projects that don't pan out. It's reserved, so nothing else can officially use it. It's documented, so it appears in every comprehensive port list. But it's not really part of the living Internet.

This isn't a failure. It's just reality. Not every protocol succeeds. Not every good idea gets adopted. The CAB Protocol joined hundreds of other registered services that made sense to someone, somewhere, but never reached critical mass.

Checking What's Listening

If you want to verify nothing is using port 595 on your system:

Linux/Mac:

sudo lsof -i :595
netstat -an | grep 595

Windows:

netstat -an | findstr :595

No output means no service is listening. That's the expected result.

The Difference Between Reserved and Used

Port 595 is reserved. That's different from used. Reserved means IANA has recorded it in the official registry. Used means actual traffic flows through it, actual services depend on it, actual people would notice if it disappeared.

Port 22 (SSH) is both reserved and used. Port 443 (HTTPS) is both reserved and used. Port 595 is reserved but not used—at least not widely enough to matter to most networks.

Related Ports

• Port 593 — HTTP RPC Endpoint Mapper, sometimes confused with 595
• Port 135 — Microsoft RPC Endpoint Mapper, the more common RPC mapping service
• Ports 1024-49151 — Registered ports range, where less critical services typically get assigned