What Port 1995 Is
Port 1995 sits in the registered port range (1024–49151) — the middle tier of the port number system, where IANA assigns names to ports that specific applications or vendors have claimed.
IANA registered port 1995 as "perf-port" for Cisco performance monitoring. That's the official story. In practice, the port sees almost no traffic, has no active open-source ecosystem around it, and isn't referenced in modern Cisco documentation in any meaningful way. It's a registration without a constituency.
The Registered Port Range
The port number space is divided into three tiers:
- Well-known ports (0–1023): HTTP, SSH, DNS, SMTP — the foundations. Assigned by IANA, require root/admin privileges to open.
- Registered ports (1024–49151): Where port 1995 lives. Anyone can request a registration from IANA, and vendors often do to stake a claim for their software.
- Dynamic/ephemeral ports (49152–65535): Temporary ports your OS assigns for outbound connections. No names, just numbers.
A registered port is a soft reservation. IANA records the association, but there's no enforcement. If some other application decides to use port 1995, nothing stops it. The registry is a directory, not a lock.
Why This Port Matters (Even If It's Quiet)
Unassigned and lightly-used ports are part of what makes port scanning meaningful in security. When something unexpected appears on port 1995 — or any unusual port — it's worth asking why. Legitimate Cisco monitoring tools rarely use it; most modern Cisco performance instrumentation has moved to SNMP, NETCONF, gRPC, and streaming telemetry on well-documented ports.
If you see traffic on port 1995, the honest answer is: investigate. It's probably something mundane (a misconfigured internal tool, an old appliance, a coincidence of ephemeral port assignment), but the quieter a port is in normal usage, the more worth noting when it appears.
How to Check What's Listening
Linux / macOS:
Windows:
The process ID in the output maps to a running process. On Linux, ss -tlnp shows the process name directly. On Windows, take the PID to Task Manager or run tasklist | findstr <PID>.
Frequently Asked Questions
Ця сторінка була корисною?