Three ancient registrations share this number and none of them is what you actually found.
IANA lists both garcon and puprouter on 999/tcp, plus Applix ac on 999/udp — legacy assignments with no descriptions and no public specifications. Nothing in current use implements any of them. What people actually do with 999 is pick it because it is memorable: alternate HTTP admin interfaces on consumer routers and IP cameras, proxies, and application ports on hosts that wanted something out of the way. Identify it by response, not by name; an HTTP request is the fastest first probe.
Expose with care
No standard service means no standard security story. If it turns out to be a device's web admin UI — the most common case — that is a management plane and should not be internet-facing.
$ curl -sv -o /dev/null --max-time 5 http://TARGET:999/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.