Port 1686: cvmon — The Registered Ghost

Port 1686 sits in the registered port range (1024–49151) — the middle tier of the port numbering system, where applications and services claim numbers through IANA to avoid stepping on each other. Unlike the well-known ports below 1024 (HTTP, SSH, DNS), registered ports don't carry system-level authority. They're agreements: a service files paperwork, gets a number, and in theory the world knows what's running if you see traffic on that port.

Port 1686 is registered to a service called cvmon, assigned to a contact named Carol Ann Krug.¹ That's essentially all the public record shows. There's no RFC. No product documentation. No vendor that publicly claims it. cvmon — likely short for some kind of monitoring service — filed for a port number and then vanished from the public Internet.

What This Range Means

Registered ports (1024–49151) are assigned by IANA upon request. Any organization or individual can apply. IANA records the service name and contact, but doesn't require ongoing proof that the service is active, widely deployed, or even still exists. The registry is a snapshot in time, not a living inventory.

This is why you'll find hundreds of registered ports with sparse or absent documentation. Someone needed a number, filed for one, and the registration outlasted the project — or the company, or the interest.

What You Might Actually See on Port 1686

If you find traffic on port 1686, it's almost certainly not cvmon (whatever cvmon was). In practice, unrecognized traffic on registered ports usually means one of three things:

• A developer chose this port for an internal service without knowing or caring about the IANA registration
• A game, VPN client, or peer-to-peer application is using it temporarily
• Something is running that you should investigate

How to Check What's Listening

# On Linux/macOS — show what process owns port 1686
sudo lsof -i :1686

# Or with netstat
netstat -tlnp | grep 1686

# On Windows
netstat -ano | findstr :1686
# Then look up the PID in Task Manager

If something is listening on 1686 on your system and you don't know what it is, that's worth understanding. The port's obscurity makes it attractive to software that wants to avoid notice — including malware that prefers numbered ports nobody's watching.

Why Ghost Registrations Exist

The registered port range has about 48,000 slots. IANA has assigned thousands of them over decades. Many of those assignments belong to products that were discontinued, companies that were acquired, or projects that never shipped. The names linger in the registry long after anyone involved has moved on.

cvmon is one of those. The port is taken. The story behind it is gone.