Port 1627 carries the T.128 Gateway protocol, an ITU-T standard for multipoint application sharing in video conferences. It's a registered port officially assigned by IANA for this specific purpose.
What T.128 Does
T.128 solves a problem from the era before Zoom and modern screen sharing: How do you let multiple people in different locations work on the same application during a conference?
The answer was elegant for 1998. Instead of running separate copies of an application at each site and trying to keep them synchronized, T.128 lets one application run at one location while other participants view and control it remotely. They send keyboard input and mouse movements over the network. The application thinks it's being used locally. Everyone else sees what's happening and can request control.
It's like passing a single keyboard around a conference table, except the table spans continents.
How It Works
T.128 sits within the T.120 protocol suite, the ITU-T's framework for real-time data conferencing. The suite includes:1
- T.126 — Shared whiteboard
- T.127 — File transfer during conferences
- T.128 — Application sharing (this port)
- T.134 — Text chat
T.128 uses services from T.122 (Multipoint Communication Service) and T.124 (Generic Conference Control) to manage the multipoint connections and conference state.2
When someone shares an application:
- The application is advertised to all conference participants
- Participants see a view of the application's window
- Under specified conditions, a participant can request control
- Their keyboard and pointing device inputs are sent to the host
- Screen updates flow back to all viewers
The host runs the application. Everyone else operates it remotely. One instance, multiple controllers.
The Problem It Solved
In the late 1990s, video conferencing systems needed a way to collaborate on documents, spreadsheets, and presentations during meetings. You couldn't just "share your screen"—that concept didn't exist in the mainstream yet.
T.128 provided the illusion that the application was running locally on your machine when it was actually running somewhere else. You clicked, you typed, and it responded. The network delay was the only reminder that the application lived far away.
This mattered for corporate conferencing systems, distance learning, and remote collaboration before broadband, before cloud applications, before the web made everything a shared experience by default.
Why This Port Is Rarely Seen Today
The problem T.128 solved has been solved differently now.
Modern screen sharing is simpler: capture the screen, compress it, stream it. Tools like Zoom, Teams, and Google Meet don't need elaborate application control protocols. They just show you pixels. When you want to collaborate on a document, you use Google Docs or Office 365—applications designed from the ground up to be multiuser.
T.128 came from an era when applications were local, networks were slow, and collaboration meant remote control rather than shared state.
The port remains registered. The protocol is still defined in ITU-T documentation. But the world moved on to different solutions.
Security Note
Port 1627 has occasionally been associated with malware in the past, as many registered ports have been co-opted by trojans over the years.3 If you see unexpected traffic on port 1627 and you're not running legacy conferencing equipment, investigate.
How to Check What's Using Port 1627
On Linux or macOS:
On Windows:
If something is listening on port 1627 and you don't recognize it, identify the process and determine whether it's legitimate conferencing software or something else.
Related Ports
- Port 1503 — T.120 (the broader conferencing protocol suite)
- Port 1718-1719 — H.323 Gatekeeper (another ITU-T conferencing standard)
- Port 5060 — SIP (modern VoIP and conferencing signaling)
What This Port Represents
Port 1627 is a marker of a different era in collaboration technology. An era when sharing an application meant giving someone remote control of your keyboard and mouse. When video conferences required dedicated equipment and ITU-T protocols. When the Internet was something you dialed into, not something you lived in.
The port is still there, officially registered, technically defined. A door that hardly anyone opens anymore, but that remains part of the address space—a reminder of how we used to work together across distances.
Frequently Asked Questions About Port 1627
此頁面對您有幫助嗎？