12345

Port 12345/tcp is a registered-vs-de-facto split: IANA registers it as italk with the description "Italk Chat System" on both TCP and UDP, while the port's real fame comes from the NetBus backdoor, which IANA does not register. NetBus (Swedish for "NetPrank") is a remote-administration trojan written in Delphi by Carl-Fredrik Neikter, first released in March 1998 — actually in circulation before Back Orifice. It uses a GUI client controlling a victim-side server (commonly named Patch.exe or SysEdit.exe) over TCP, listening by default on port 12345 with port 12346 used for some operations (NetBus 2.0/"NetBus Pro," 1999, moved to 20034). Its capabilities included keystroke logging, file manipulation, screen and input control, and full remote control of Windows hosts, and it directly inspired SubSeven. The IANA reference field for the italk registration is blank. Security-wise, 12345 is a classic NetBus infection indicator that scanners and IDS signatures key on (traffic sourced from server port 12345 historically flagged a NetBus server), but false positives are common: the italk chat system, the NetBuster honeypot (which impersonates a NetBus server), and the game Little Fighter 2 all use 12345. NetBus is also notable for a 1999 Swedish case in which it was used to plant illicit images on an academic's computer, leading to an acquittal in 2004 once the court accepted the machine had been remotely controlled. For an analyst, an open 12345 on a modern, supported Windows host is far more likely benign — a custom application, a game, or a misconfigured service — than real NetBus, which is effectively extinct; still, verify the bound process, and treat legacy XP-era or air-gapped systems as carrying residual risk.

IANA assignment

italk — "Italk Chat System"; reference (blank — no RFC cited in IANA registry); registered for 12345/tcp and 12345/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Prevalence

appears in port scans / nmap-services as a watched port (de-facto) [Well-established] — nmap-services file

Related ports

12346 (NetBus secondary), 20034 (NetBus 2 Pro); contrast 31337 (Back Orifice), 1243/6776 (SubSeven)

De-facto use

NetBus remote-administration trojan (NOT the IANA registration)

Primary use (de-facto)

NetBus RAT default listener

Other/unofficial uses

italk chat (legacy, mostly Japan); NetBuster honeypot; Little Fighter 2 game [Well-established]

Security implications

classic NetBus infection indicator and IDS signature (server-port-12345 detection); common false positives (italk, NetBuster, LF2); NetBus largely extinct on supported Windows

Typically seen on

historically NetBus-infected Windows hosts / IDS alerts; today custom apps, games, honeypots

Analyst note

An open 12345 on a modern host is more likely benign (custom app, game, misconfig) than real NetBus. Verify the bound process; legacy XP-era/air-gapped systems carry residual risk.