# WHATPORT(65000)

## NAME

port 65000 — Unassigned — round number with a DDoS-tool history — A round number near the top of the port space, remembered mainly for 1999-era DDoS handlers.

Protocol: TCP  
IANA registry

## DESCRIPTION

65000 is unregistered and unregisterable: RFC 6335 reserves 49152-65535 for dynamic and private use. Its 0.000760 frequency in Nmap's nmap-services reflects how often people pick round numbers for ad hoc listeners. The SANS ISC port page attaches a set of legacy backdoor and DDoS names to it — Devil, Sockets des Troie, and the Stacheldraht agent and handler, the last being a real 1999 distributed denial-of-service toolkit — all of which are historical rather than current threats. Today a listener here is far more likely to be someone's own service on a memorable port than any of those.

## EXPOSURE

**Expose with care.** Round, memorable ports get scanned constantly and forgotten easily. Identify the process; if you cannot, close it rather than leaving it reachable.

## CHECK

```sh
sudo lsof -nP -iTCP:65000 -sTCP:LISTEN
```

## SEE ALSO

- spec — [RFC 6335 — Dynamic Ports (49152-65535)](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- iana — [IANA port registry — search 65000 (no assignment)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=65000) (iana.org)
- docs — [SANS Internet Storm Center — port 65000 activity and historical names](https://isc.sans.edu/port.html?port=65000) (isc.sans.edu)

---

HTML: <https://whatport.net/65000/> · JSON: <https://whatport.net/65000.json> · full dataset: <https://whatport.net/ports.json>