No IANA assignment — it sits in the dynamic/private range — but it is the documented listener for Ivanti Device and Application Control's Application Server when TLS is off.
65129 is above 49151, so IANA never assigns it; RFC 6335 reserves 49152-65535 as the Dynamic/Private range for ephemeral and private use. The one well-documented service here is Ivanti Device and Application Control (the old SecureWave/Sanctuary endpoint-control product), whose Application Server listens on 65129 for client and peer-server traffic, or on 65229 when TLS is enabled; managed clients listen on 33115 for server-initiated calls. Otherwise it is an ordinary high port: Windows and macOS/BSD draw ephemeral source ports from 49152-65535, so a 65129 in a packet capture is usually just a client socket. Nmap's service database has no name for it and records it open on roughly 0.04% of scanned hosts.
Do not expose
If this is the Ivanti Application Server, it is an endpoint-security management plane running without TLS — keep it on a management network, and prefer the TLS listener on 65229. An unidentified listener here should be identified before it faces anything.
$ sudo lsof -nP -iTCP:65129 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.