Port 1989: Two Footnotes — Cisco's Token Ring Bridge and Australia's Pre-Internet Network

Port 1989 sits in the registered port range (1024–49151), where IANA keeps track of services that have claimed a number but don't carry the automatic system-level weight of the well-known ports below 1024. Most registered ports belong to one thing. Port 1989 belongs to two — and both of them are ghosts.

What IANA Says

IANA lists two assignments for port 1989:

• tr-rsrb-p3 — Cisco RSRB Priority 3
• mhsnet — MHSnet system

Neither is in active use. Both tell a story.

Cisco RSRB: Token Ring's Last Stand

In the late 1980s and early 1990s, IBM's Token Ring was a genuine competitor to Ethernet. Many enterprise networks were built on it. Cisco, connecting everything to everything, built Remote Source-Route Bridging (RSRB) to carry Token Ring traffic over IP networks — letting Token Ring segments that weren't physically adjacent communicate as if they were.¹

RSRB used three ports for traffic prioritization:

Port 1989 was the lowest-priority RSRB channel. When networks got congested, traffic here waited. Token Ring lost to Ethernet anyway, and RSRB went with it. The ports remain registered; the traffic has been gone for decades.

MHSnet: Australia Before the Internet

The second assignment is stranger and more interesting.

MHSnet (Message Handling System Network) was developed at the University of Sydney by Piers Lauder and Bob Kummerfeld. Originally called SUNIII (Sydney University Network version 3), it was a store-and-forward system — like UUCP, but smarter. It supported dynamic routing, a hierarchical namespace, and efficient transfer of email, Usenet, and files over non-dedicated dial-up links.²

From 1979 onward, MHSnet was the backbone of ACSnet, the Australian Computer Science Network, which connected Australian universities to each other and to ARPANET. Before fiber, before AARNet, before the Internet reached the southern hemisphere properly — MHSnet was how Australian academics sent email to the United States.

Then, in 1989, AARNet launched. Australia got a real Internet connection. Universities switched over. MHSnet, which had served the continent for a decade, became obsolete almost overnight.³

The IANA registration for port 1989 likely dates to around this transition. It's an artifact — a port number assigned to a network that was already being retired at the moment of registration.

Security

No active malware families are known to use port 1989. Some older security databases flag it with historical associations, but there are no current documented threats specific to this port.

If you see unexpected traffic on port 1989, it's almost certainly an application that chose this number arbitrarily — not a legacy MHSnet node or RSRB bridge.

Check What's Using This Port

If port 1989 shows activity on a machine you control, check it:

macOS / Linux:

lsof -i :1989

Windows:

netstat -ano | findstr :1989

Then cross-reference the process ID:

# macOS / Linux
ps aux | grep <PID>

# Windows
tasklist | findstr <PID>

Why Unassigned (and Obsolete) Ports Matter

The registered port range exists so that software can pick a number that won't collide with something else. When a service registers a port and then disappears, the number doesn't get recycled — IANA generally holds them to prevent confusion.

This creates a long tail of registered ports attached to dead software: enterprise protocols that lost market share, academic networks superseded by the Internet itself, research projects that became publications instead of products. Port 1989 holds two of them.

The port numbers are a census of what people once thought was important enough to claim.