Port 60112 — The Unassigned Port

What Range Is This?

Port 60112 falls in the dynamic/ephemeral port range (49152–65535), which the Internet reserves for temporary use. These are the ports applications grab when they need a communication channel without requesting an official assignment.

The ephemeral range exists because the Internet learned early on that you can't predict every use case. Instead of trying to name every possible service, the protocol designers said: "Below 49152, we'll keep things organized. Above that, it's yours."

Known Uses

Port 60112 isn't assigned to anything official, but it appears in two places:

Windows DNS Socket Pool — When Microsoft updated Windows DNS servers to prevent spoofing attacks, they needed a way to randomize the source port of outgoing queries (a security technique). Windows DNS reserves a pool of 2,500 ports in the ephemeral range to rotate through, and 60112 can be one of them. If you see your Windows DNS server listening on 60112, that's not a break-in—it's security theater. ¹

Apple Xsan Filesystem Access — Apple reserves the entire range 49152–65535 for Xsan, its distributed storage system. Port 60112 falls in this range, though Apple doesn't document what specific function (if any) this port performs. ² It could be active on any Mac running Xsan, or it could be silent—the specification just reserves the territory.

How to Check What's Listening

If you want to know what's actually using port 60112 on your machine:

macOS/Linux:

lsof -i :60112
netstat -tulpn | grep 60112
ss -tulpn | grep 60112

Windows:

netstat -ano | findstr :60112
Get-NetTCPConnection -LocalPort 60112

If nothing shows up, the port is sitting empty. If something does, these commands will show you the process ID, which you can trace to an application.

Why Unassigned Ports Matter

The fact that 60112 has no official name tells you something important about how the Internet actually scales: the bureaucracy of port assignment stops working once you get past the well-known services. IANA maintains the official registry ³, but there's no way to officially assign ~16,000 ephemeral ports to specific uses. The system solved this by making those ports available for anything.

This means:

• Custom applications use these ports without asking permission
• Your operating system reserves thousands at a time for internal use
• Network scanners show these ports as "unknown" because they often are
• Security scanning is harder because you can't just look up what a port is supposed to do

Port 60112 is probably being used right now, somewhere on the Internet, by something without a name. That's normal. The Internet doesn't break if you don't know what every port does.