# WHATPORT(1002)

## NAME

port 1002 — Unassigned — nmap labels it windows-icfw — Unassigned at IANA; scanners print "windows-icfw" from an old Windows-era name, not from anything running today.

Protocol: TCP  
IANA registry

## DESCRIPTION

1002 sits in IANA's unassigned 1002–1007 block, so there is no registered service. nmap's service table still carries the historical label windows-icfw, annotated as the Windows Internet Connection Firewall or the Internet Locator Server used by NetMeeting, and that is the name most scan reports repeat. Neither is a live protocol on modern systems. Being under 1024, a listener here was started by a privileged process, so it is deliberate.

## EXPOSURE

**Expose with care.** The scanner's label is a historical guess, not evidence. Identify the actual service before you decide anything about exposing it.

## CHECK

```sh
sudo lsof -nP -iTCP:1002 -sTCP:LISTEN
```

## SEE ALSO

- iana — [IANA Service Name and Transport Protocol Port Number Registry (1002–1007 unassigned)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)
- source — [nmap-services (1002/tcp windows-icfw)](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/1002/> · JSON: <https://whatport.net/1002.json> · full dataset: <https://whatport.net/ports.json>