# WHATPORT(12345)

## NAME

port 12345 — NetBus (in practice) / italk (IANA) — The most-typed port number there is: registered to italk, famous as the NetBus backdoor, and used daily as a throwaway test port.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA registers 12345 to `italk`, the Italk Chat System, which nobody runs. The number's reputation comes from NetBus, a Windows remote-control backdoor from 1998 that listened on 12345 with a second channel on 12346, and which is well enough documented that Nmap ships a `netbus-info` NSE script and Nmap's service table names the port `netbus`. Trend Micro's OfficeScan agent also used 12345, which produced a long history of false-positive backdoor alerts on corporate desktops. In modern practice most sightings are neither: 12345 is the reflexive choice for a scratch listener, a debug server, or a container port mapping.

## EXPOSURE

**Do not expose.** Either it is a remote-control backdoor, or it is a hastily configured test service that nobody hardened. Neither belongs on a public IP.

## CHECK

```sh
nmap -Pn -p 12345 --script netbus-info TARGET
```

## SEE ALSO

- docs — [Nmap NSE — netbus-info](https://nmap.org/nsedoc/scripts/netbus-info.html) (nmap.org)
- iana — [IANA port registry — 12345 (italk)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=12345) (iana.org)

---

HTML: <https://whatport.net/12345/> · JSON: <https://whatport.net/12345.json> · full dataset: <https://whatport.net/ports.json>