Port 1741: Unassigned — Quiet on Paper, Active in Factories

Port 1741 belongs to the registered port range (1024-49151). IANA maintains this range: vendors can formally request assignments here for their protocols, and IANA tracks what's official. Port 1741 has no such assignment. Nobody has claimed it.

That doesn't mean nothing runs on it.

What the Registered Range Means

The registered port range sits between the well-known ports (0-1023, which require root/admin to bind) and the ephemeral ports (49152-65535, used for temporary client-side connections). Registered ports are accessible by any process without special privileges, which makes them attractive for application protocols.

When a port in this range is officially registered, IANA records the service name, protocol, and contact. When it isn't — as with 1741 — anything can use it. And often, something does.

The CODESYS Connection

In industrial control networks, port 1741 appears as part of a four-port discovery block used by CODESYS — a widely used runtime environment for programming PLCs (programmable logic controllers). CODESYS broadcasts across UDP ports 1740-1743 to locate controllers on the local network, letting the development environment discover devices without manual configuration.¹

Port 1741 is specifically CODESYS channel 1 in this discovery scheme. Schneider Electric's Modicon M241/M251 controllers, among many others, listen on these ports for discovery traffic.²

This use is unofficial — CODESYS hasn't registered these ports with IANA — but it's real and widespread in manufacturing and industrial automation environments. If you see UDP traffic on port 1741 inside an operational technology (OT) network, CODESYS device discovery is the most likely explanation.

Security note: CODESYS documentation explicitly warns that ports 1740-1743 should never be exposed to the Internet without protection. These are programming interfaces — direct access to controllers. Firewalls should block them at the network perimeter.³

How to Check What's Using This Port

If you see activity on port 1741 and need to know what's responsible:

On Linux/macOS:

# Show what process is listening on port 1741
ss -tulnp | grep 1741

# Or with lsof
lsof -i :1741

On Windows:

netstat -ano | findstr :1741

The process ID in the output can be matched to a process name in Task Manager or with tasklist.

With Wireshark: Filter for tcp.port == 1741 or udp.port == 1741 to inspect the traffic directly. If you see short UDP broadcasts going to 255.255.255.255 or a subnet broadcast address, CODESYS discovery is the likely culprit.

Why Unassigned Ports Matter

The 65,535 available ports are finite. The registered range has tens of thousands of assignments, but also thousands of gaps — ports like 1741 that sit unclaimed. These gaps aren't wasted space; they're the buffer that lets software use ports without collision, even without formal registration.

The problem is opacity. A well-known port (80, 443, 22) carries an implicit contract: you know what's supposed to be there. An unassigned port carries no such contract. When you see traffic on port 1741, you have to investigate. That investigation — what process, what protocol, what purpose — is basic network hygiene.

Unassigned ports showing unexpected activity are worth understanding, not ignoring.