Port 1685 has a name in the IANA registry: n2nremote. But the name raises more questions than it answers — most port databases just repeat it without explanation, and few people running network scans have any idea what it means.
Here's what it actually is.
What n2nremote Is
n2n is an open-source, layer-2 peer-to-peer VPN created by Luca Deri and Richard Andrews at ntop, the same team behind ntopng and other network monitoring tools. The "remote" in n2nremote refers to the remote registration component — how devices announce themselves and find each other in the network.
Most VPNs work by routing your traffic through a central server. You connect to the server, the server connects to the destination, and everything flows through the middle. n2n works differently: it lets two devices establish a direct encrypted tunnel between themselves, cutting out the middleman entirely.
The Problem n2n Solves
The hard part of peer-to-peer networking is NAT. When you're behind a home router, your device doesn't have a public IP address — your router does. Two devices behind two different NAT routers can't easily connect directly because neither knows how to reach the other.
n2n solves this through supernode infrastructure: a lightweight central coordinator that helps devices find each other and punch through NAT. Once the introduction is made, traffic flows directly between peers. The supernode is a matchmaker, not a middleman.
Port 1685 is where n2nremote registers — devices use it to announce their presence and negotiate connections.
Who Uses It
n2n is a niche tool with a small but dedicated user base. It appears in:
- Self-hosted home lab setups where users want device-to-device connectivity without a cloud VPN provider
- Gaming communities running private LAN-style sessions over the Internet
- Embedded and IoT projects where lightweight VPN solutions matter
- Developers who want encrypted peer-to-peer tunnels without the overhead of traditional VPN infrastructure
It has never achieved mainstream adoption, which is why most network administrators encounter port 1685 and find nothing useful in their reference materials.
Security Considerations
Because n2n is obscure, port 1685 traffic is rarely expected. If you see unexpected activity on this port, it warrants investigation — not because n2n itself is malicious, but because unfamiliar software establishing encrypted tunnels is worth understanding.
Some security databases flag port 1685 with generic "virus port" warnings. These are not specific to n2n. They reflect historical scanning activity, not documented malware use on this port.
How to Check What's Listening
If port 1685 is active on a machine you control:
macOS / Linux:
Windows:
Cross-platform (nmap):
The process name will tell you whether it's legitimate n2n software or something unexpected.
Port Range Context
Port 1685 sits in the registered ports range (1024–49151). This range is administered by IANA for applications that request a permanent assignment. Registration means the port is reserved in the official registry — it does not mean the software is widely deployed, actively maintained, or even still in use.
Many registered ports are assigned to software that peaked in the early 2000s, never gained traction, or quietly faded. Port 1685 is an exception: n2n is actively maintained and still sees development as of 2024.
Related Ports
n2n's supernode typically listens on port 7654 by default, though this is configurable. If you're investigating n2n activity, check both ports.
Frequently Asked Questions
此頁面對您有幫助嗎？