Port 532: Netnews — A ghost from USENET's early days

What Runs on Port 532

Port 532 is officially assigned to "netnews" with the service name "readnews" by IANA.¹ Both TCP and UDP are registered for this port, though the service primarily used TCP.

This port was designed for reading USENET news articles — the Internet's original distributed discussion system. Think of USENET as Reddit's grandfather: topic-based forums (newsgroups) where people posted messages that propagated across thousands of servers worldwide.

But here's the thing: nobody uses port 532 anymore. It's been obsolete for nearly 40 years.

Why This Port Exists (and Why It Doesn't Matter)

In the early 1980s, USENET operated over UUCP (Unix-to-Unix Copy Protocol), with news articles transferred via dial-up telephone connections between servers. As the Internet grew, there was a push to make news accessible over TCP/IP networks.²

Port 532 was assigned for "readnews" — a service that let users connect to a news server and read articles. It was separate from the ports used for transferring articles between servers.

Then in March 1986, Brian Kantor and Phil Lapsley published RFC 977, which defined the Network News Transfer Protocol (NNTP).³ NNTP unified everything — reading, posting, and transferring articles — into a single protocol running on port 119.

NNTP won. Port 532 became irrelevant overnight.

The Well-Known Port That Nobody Knows

Port 532 sits in the well-known port range (0-1023), which means it was important enough to get an official IANA assignment.⁴ These ports are reserved for system services and require root/administrator privileges to bind on Unix-like systems.

But importance in the 1980s doesn't mean importance today. Port 532 is a monument — a reminder that the Internet's infrastructure includes layers of abandoned protocols, assigned ports for services that vanished, and numbers reserved for software nobody runs.

If you scan a modern network, you'll almost certainly find port 532 closed. Nothing listens there. Nothing needs to.

What Actually Uses Port 119 Now

If you're curious about USENET today, it still exists — though mostly for binary file distribution rather than discussion. Modern NNTP servers use:⁵

• Port 119: Standard NNTP (unencrypted)
• Port 563: NNTP over TLS/SSL (encrypted)

These are the ports that matter. Port 532 is just a footnote.

How to Check What's Listening on Port 532

On most systems, port 532 will be closed because nothing uses it. But you can verify:

Linux/Mac:

# Check if anything is listening on port 532
sudo lsof -i :532

# Or use netstat
sudo netstat -tlnp | grep :532

Windows:

# Check listening ports
netstat -ano | findstr :532

If you find something listening on port 532, it's either:

1. A very old legacy system running archaic news software
2. A custom application repurposing an unused port
3. Malware (uncommon, but unassigned/unused ports sometimes get exploited)

Why Obsolete Ports Matter

Port 532 teaches us something important about Internet infrastructure: assignments are forever, but relevance isn't.

The port number registry is full of ghosts like this — services assigned in the 1980s and 1990s that nobody uses anymore but remain officially registered. They can't be reassigned because someone, somewhere, might still be running that old software.

This is why the well-known port range (0-1023) filled up. Once assigned, ports rarely get reclaimed. Port 532 will probably remain "netnews/readnews" in the IANA registry forever, even though the last person to actually use it probably retired before smartphones existed.

The Lesson of Port 532

Every port tells a story. Port 532's story is about how quickly technology moves. A protocol important enough to get a well-known port assignment became obsolete within a few years. NNTP was simply better — it unified reading and transferring into one protocol, and it won.

Port 532 didn't fail. It just got replaced by something better. That's how the Internet evolves.

If you're scanning your network and see port 532 open, you've found either a museum piece or a mystery. Either way, it's worth investigating — because in 2025, nothing legitimate should be listening there.