# WHATPORT(6646)

## NAME

port 6646 — Unassigned — Unassigned at IANA, but seen open more often than its neighbours in Nmap's scan data.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA lists the block 6641-6652 as Unassigned, so 6646 has no registered service. Nmap's service database gives it no name either, yet records it with an open-frequency an order of magnitude above the surrounding unnamed ports — meaning real software binds it in the field without any registration behind it. Endpoint-security agents are the usual suspects on Windows hosts, but no vendor documentation pins the port down, so identify the owning process rather than guessing from a name table.

## EXPOSURE

**Expose with care.** An unregistered port that is nevertheless commonly open is exactly the kind of listener worth naming before you leave it reachable.

## CHECK

```sh
sudo lsof -nP -iTCP:6646 -sTCP:LISTEN
```

## SEE ALSO

- iana — [IANA Service Name and Transport Protocol Port Number Registry — 6646](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6646) (iana.org)
- source — [nmap-services (Nmap's port/service frequency database)](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/6646/> · JSON: <https://whatport.net/6646.json> · full dataset: <https://whatport.net/ports.json>