Port 1029: Solid-mux — The port with an identity crisis

Port 1029 has a split identity. Officially, it's registered with IANA for a service called "Solid Mux Server."¹ In reality, most people encounter it as one of the dynamic ports Windows systems use for DCOM and RPC communication.²

The registered port

Port 1029 sits in the registered port range (1024-49151), which means someone formally requested it from IANA for a specific service. That service—solid-mux, or "Solid Mux Server"—got the registration, but the protocol is obscure enough that you'll find almost no documentation about what it actually does or who uses it.

This is common in the registered range. Organizations and developers reserve ports for services that may never become widely deployed. The reservation prevents conflicts, but it doesn't guarantee the port will be used for its intended purpose.

What you'll actually see

When port 1029 appears on your network, it's usually not solid-mux. It's Windows.

On Windows systems prior to Windows Server 2008, DCOM services used a dynamic port range of 1024-5000 by default.³ When Windows needs to establish RPC communication for remote administration, Windows Management Instrumentation (WMI), or distributed component services, it picks an available port from this range. Port 1029 is one of those possibilities.

This creates a strange situation: the port is registered for one thing but actively used for another. The official assignment sits dormant while the port does unofficial work.

Why dynamic ports complicate security

DCOM's use of dynamic ports creates headaches for firewall configuration. You can't just open port 1029 and call it done—Windows might choose any port in the range. Network administrators either open the entire range (creating a large attack surface) or configure RPC to use a restricted range, then open only those specific ports.⁴

Microsoft recommends opening at least 100 ports for RPC communication because multiple system services need these channels simultaneously.³ Modern Windows versions (Server 2008 and later) shifted the default dynamic range to 49152-65535, moving most of this traffic to the ephemeral port range and leaving registered ports like 1029 less frequently used.

Checking what's listening

To see if anything is listening on port 1029:

On Linux/Mac:

sudo lsof -i :1029

On Windows:

netstat -ano | findstr :1029

If you find something listening, it's probably a Windows service temporarily using the port for RPC/DCOM communication rather than the official solid-mux service.

The gap between registration and reality

Port 1029 demonstrates the difference between the Internet's official records and its actual behavior. IANA maintains the registry. Network protocols follow RFCs. But the real Internet is messier—ports get borrowed, services use "temporary" solutions that become permanent, and official assignments gather dust while the ports do other work.

The registry says solid-mux. The network traffic says DCOM. Both are true, in their own way.

Related ports

• Port 135 - Microsoft RPC Endpoint Mapper (the well-known port that coordinates dynamic port assignment)
• Ports 1024-5000 - Traditional Windows RPC dynamic range (pre-2008 systems)
• Ports 49152-65535 - Modern ephemeral port range (Windows Server 2008 and later)