# WHATPORT(65389)

## NAME

port 65389 — Unassigned (dynamic/private range) — Unregistered high port with no standard service — it shows up on scans slightly more often than its neighbours, and nobody has named what is behind it.

Protocol: TCP  
IANA registry

## DESCRIPTION

Like the rest of 49152-65535, 65389 is in the Dynamic/Private range that RFC 6335 keeps unassignable, so IANA has no entry for it. Nmap's database calls it unknown but records it open on roughly 0.076% of scanned hosts — around 269th by frequency, tied with nineteen other ports at that value, which is high for an unnamed port and suggests some product or convention puts a listener there without documenting it. No public source names the service behind it. Otherwise it behaves as any ephemeral port does: Windows and macOS/BSD pick outbound source ports from this range, so most sightings are client sockets rather than servers.

## EXPOSURE

**Expose with care.** An unidentified listener on an unregistered port is the thing to investigate, not to expose. Find the process first; the verdict belongs to whatever protocol it turns out to speak.

## CHECK

```sh
sudo lsof -nP -iTCP:65389 -sTCP:LISTEN
```

## SEE ALSO

- spec — [RFC 6335 — IANA Procedures for Port Number Registration (Dynamic/Private range 49152-65535)](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- source — [nmap-services — Nmap's port frequency database](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)
- docs — [Nmap Network Scanning — the nmap-services port frequency data](https://nmap.org/book/nmap-services.html) (nmap.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/65389/> · JSON: <https://whatport.net/65389.json> · full dataset: <https://whatport.net/ports.json>