The Port That Doesn't Exist
Port 0 is supposed to be the port nobody uses. This afternoon I opened a live chat session on it from a cloud server, watched the handshake in a packet capture, and said hello to a room full of strangers. It took about fifteen minutes.
The spark was a great write-up by acidvegas called The Port That Does Not Exist, which scanned the entire IPv4 internet for anything answering on port 0. The short version is that a lot of things answer, and some of them really shouldn't. I wanted to see it with my own eyes, so I did.
Port 0 is a software convention, not a wall
When a program asks the operating system for port 0, it's really saying "give me any free port." That's why nobody can normally listen there. The rule lives in the software, though, not in the network.
On the wire, a TCP port is just a 16-bit number, and zero fits in 16 bits like any other value. The standards call port 0 reserved, not forbidden. So a single forwarding rule on a router or firewall can quietly send port 0 traffic to a real service sitting on some other port.
The tooling is where it gets funny. Many everyday network utilities refuse to even try port 0, browsers block it outright, and most scanners skip it by default. Everyone has agreed it isn't a real port, which makes it a pretty good place for things to hide.
Seeing it firsthand
The author runs an IRC network and, purely to flex, set it up to accept connections on port 0 (and encrypted ones on port 1). I pointed a Linux box at it, one with no next-generation firewall in the path, and went to work.
First attempt looked dead. No greeting, nothing. It turned out the connection was fine and the chat server simply waits silently for you to introduce yourself. Old IRC habits come back slowly.
Second attempt connected. The packet capture showed a textbook three-way handshake, with the reply coming from source port 0. That's the moment it got real.
Then the encrypted door. Same trick on port 1 with TLS, and the server flagged my session as secure.
Then a clean goodbye. A proper quit, both sides closed the encrypted session politely, and the server even labeled my exit with a joke.
One of the network's servers dropped my port 0 attempts while another accepted them. That alone is a lesson. Whether port 0 works depends on every hop in between, not just the endpoints.
What's actually out there on port 0
The original scan got over a million responses, but nearly all of them were edge devices answering for entire address blocks and then saying nothing. After filtering out that noise and some chatty load balancers, roughly 2,900 addresses were running a real service on port 0.
The services themselves were mostly boring and familiar. Think remote login, databases, file transfer, mail, and router admin pages. What made the list unsettling was how much of it runs physical things.
Industrial controllers, including at least one machine screen viewable with no password
Building automation and HVAC control panels
Burglar alarm communicators and alarm modules that print their own default password
Utility power meters, factory floor telemetry, and network-controlled power strips
Remote desktop gateways and business application routers leaking version details
Business phone systems streaming their call logs, names and numbers included, to anyone who connects
The pattern suggests accidents, not cleverness. The same device configuration repeated across an entire ISP looks a lot like a forwarding rule shipped with the external port left at zero. Or my favorite hypothesis; ignorance wins again.
What this means for your network
Port 0 isn't a hiding spot. It's a blind spot, and those are worse because nobody's looking.
Your last external scan may not have checked it. Most scanners skip port 0 unless someone tells them otherwise. Ask whoever scans your perimeter whether it was included.
Audit your forwarding rules. A single typo or a blank field in a port forward can expose an internal service on a port nobody thinks to check.
Deny it explicitly. Don't assume your firewall drops port 0 traffic by default. Some platforms do, some don't. Write the rule and verify it.
Pay extra attention to anything that runs equipment. Phone systems, alarm panels, building controls, and industrial gear were the scariest finds, and they're often installed by a third party and then forgotten.
At Zero One Six, this is exactly the kind of gap we look for in an external review. The obvious ports get plenty of attention. The weird ones are where surprises live.
Credit where it's due
All of the internet-wide research above belongs to acidvegas, who did the scanning, the protocol detective work, and the write-up. Go read the original for the full story and the deep technical detail. It's one of the more entertaining pieces of security research I've read this year.
Comments