Port 1396: DVL Active Mail — A ghost in the registry

Port 1396 belongs to the registered ports range (1024-49151), where IANA assigns port numbers to specific services upon request. This port is officially assigned to dvl-activemail (DVL Active Mail) on both TCP and UDP.¹

But here's the strange thing: almost nothing is known about what DVL Active Mail actually was.

The Ghost Service

DVL Active Mail appears in the official IANA registry. It shows up in system port databases. Network administrators have seen references to it in /etc/services files for decades. But documentation about what this email system did, who created it, when it was used, or why it needed a dedicated port has nearly vanished from the Internet.

This is not unusual. The port registry contains hundreds of these archaeological artifacts—services that were important enough to warrant an official IANA assignment in the 1990s or early 2000s, but whose companies, protocols, and purposes have been lost to time.

What We Know

• Port number: 1396
• Protocol: TCP and UDP
• Service name: dvl-activemail
• Description: DVL Active Mail
• Range: Registered ports (requires IANA assignment)
• Status: Officially assigned but effectively obsolete

Why Unassigned and Obsolete Ports Matter

Port 1396 is technically assigned, not unassigned—but its service is so obscure it might as well be empty. These ghost ports serve an important purpose in the port system:

They preserve history. The port registry is a timeline of Internet protocols. Every assignment tells a story about what mattered at a specific moment in time. Port 1396 says: "Someone built an email system called DVL Active Mail, and it was significant enough to get an official port."

They prevent conflicts. Even though DVL Active Mail is likely unused today, keeping port 1396 reserved prevents modern applications from claiming it and potentially conflicting with any legacy systems that might still exist somewhere.

They show how the Internet evolves. Most protocols don't die dramatically. They just fade. Companies shut down. Documentation disappears. Users move to newer systems. But the port numbers remain, like empty buildings in a city that's moved on.

The Registered Ports Range

Port 1396 sits in the middle range of the port system:

• Well-known ports (0-1023): Reserved for essential protocols like HTTP, SSH, DNS
• Registered ports (1024-49151): Assigned by IANA for specific applications upon request
• Dynamic/ephemeral ports (49152-65535): Temporary ports used for outbound connections

The registered range contains thousands of ports assigned to commercial software, enterprise systems, and protocols that seemed permanent when they were registered but have since faded into obscurity.

Security Considerations

Because port 1396 is associated with an obsolete service, it's occasionally exploited by malware looking for unused ports.² If you see unexpected traffic on port 1396, investigate it:

# Check what's listening on port 1396 (Linux/Mac)
sudo lsof -i :1396
sudo netstat -tulpn | grep 1396

# Check on Windows
netstat -ano | findstr :1396

If nothing on your system should be using port 1396, and you see traffic on it, that's a red flag.

The Unanswered Questions

What was DVL Active Mail? Was it an enterprise email server? A protocol for message synchronization? A proprietary system for a specific industry?

We don't know. The company that created it left no trace. The users who relied on it moved on. The documentation, if it ever existed online, is gone.

Port 1396 is a reminder that the Internet is not permanent. Services die. Companies vanish. But the port numbers remain—placeholders for things we've forgotten we once needed.