128

Port 128/tcp is registered with IANA as gss-xlicen with the description "GSS X License Verification," assignee John Light, and a blank reference field. The same name and description are dual-registered on 128/udp, so IANA treats the two entries as one logical assignment differing only in transport protocol. This is an old system-port (0–1023 well-known range) registration whose "GSS" prefix points at a license-management/verification service rather than any IETF standards-track protocol: no RFC formalizes it, and the registry carries no document reference to leave blank rather than invent. Beyond the raw registry line the port is effectively undocumented — no assignment date is exposed in the IANA registry or any secondary source, so the date fields stay Unknown rather than being filled with a placeholder. From an analyst's standpoint port 128 is unremarkable: it carries no documented malware, trojan, or scanning-campaign association (GRC's Port Authority page for 128 has blank "Background and Additional Information" and "Related Ports" sections, and the common port-lookup aggregators — SpeedGuide, T1Shopper, adminsub.net — merely mirror the IANA gss-xlicen assignment with no added intelligence). No currently maintained software or vendor product could be confirmed to use the port for its registered purpose; the registration predates most indexed web documentation. For an analyst, a responsive port 128 is therefore best treated as an anomaly worth identifying rather than a signal of any known service in wide deployment.

IANA assignment

gss-xlicen — "GSS X License Verification"; reference blank (no RFC/document cited in IANA registry); assignee John Light; dual-registered 128/tcp + 128/udp (identical entry) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; local registry CSV lines 333–334

Range class

well-known (0–1023) [Confirmed] — IANA registry

IANA reference (RFC)

none listed — registry entry carries no RFC or document reference; left blank per no-fabrication rule [Confirmed] — IANA registry

Assignment/registration date

Unknown — blank in the registry CSV and not exposed in any secondary source; not fabricated [Confirmed] — local registry CSV lines 333–334; IANA registry

Primary use

legacy GSS X License Verification (license-management/verification service); no RFC formalizes it; appears to be a vendor/organization registration rather than an IETF standards-track protocol

Common software

Unknown — no current, actively maintained software or vendor product was found documenting real-world use of port 128 for GSS X License Verification [Unknown]

Security implications

no documented malware, trojan, or notable scanning-campaign association; GRC Port Authority page for 128 has blank background/related-ports sections; aggregator sites only mirror the IANA entry

Both transports

same service name registered for 128/tcp and 128/udp with identical description [Confirmed] — IANA registry (both angles)

Analyst note

An open port 128 is not a known-service signal; treat as an anomaly to identify (legacy license service, decoy, or repurposed listener) rather than a normal deployment.

Port 128/udp is registered with IANA as gss-xlicen with the description "GSS X License Verification" and the assignee/contact listed as [John_Light], reproduced verbatim from the registry's bracket notation. The registry's Reference (IANA/RFC) column is blank — no RFC documents this assignment — and the Registration Date, Modification Date, Service Code, Unauthorized Use Reported, and Assignment Notes columns are likewise blank in the source, so those fields stay Unknown rather than being invented. The name traces to Global Software Systems Corp (GSS), a vendor that produced X Window System license-management software in the early 1990s; the registered contact appears historically as John Light. The assignment is dual-registered: 128/tcp carries the same service name, description, and assignee, immediately preceding this UDP row in the registry CSV. In practical terms this is an obscure, vendor-specific, legacy licensing/authentication mechanism with no open standard behind it and no evidence of active modern deployment — third-party port-lookup aggregators (SpeedGuide, T1 Shopper) simply echo the IANA gss-xlicen name and add no independent technical detail. For an analyst the port is unremarkable: it does not appear in mainstream scanning telemetry, threat-intel writeups, or amplification-abuse research the way 123/udp (NTP) or 1900/udp (SSDP) do, and no CVEs, malware campaigns, or port-128-specific abuse reports were located in this pass. As with any unfiltered UDP port a bound service is scannable, but there is no documented port-128-specific exposure. A responsive 128/udp today is far more likely to be an anomaly or an unrelated custom service than legitimate GSS X-license traffic.

IANA assignment

gss-xlicen — "GSS X License Verification"; reference (blank — no RFC cited in IANA registry); assignee/contact [John_Light]; dual-registered 128/tcp + 128/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

well-known (0–1023) [Confirmed] — port number 128 is within 0–1023

Registration/modification date

blank in the IANA registry — not documented, stays Unknown [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (Registration Date / Modification Date columns blank)

Prevalence / exposure

nmap-services observed open-frequency 128/udp ≈ 0.000494 (very low — roughly 5 in 10,000 scanned hosts in the nmap-services sample) [Confirmed] — nmap-services dataset; the dual-registered 128/tcp side is rarer still at ≈ 0.000013 [Confirmed] — nmap-services dataset. Beyond that figure, 128/udp does not appear in mainstream scanning telemetry or threat-intel as a commonly probed/exploited port, and no CVEs, malware, or amplification-abuse reports tied to it were found in this pass [Unknown]

Related ports

128/tcp (same gss-xlicen service, same assignee) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Primary use

historical/vendor-specific — GSS X License Verification, a proprietary licensing/authentication mechanism for Global Software Systems Corp's X Window System products; no open standard

Common software using this port

Unknown — no current, actively-maintained software documented as using 128/udp; the only named association is the discontinued/legacy GSS X-license tooling [Unknown]

Contact provenance

registered contact historically John Light, associated with Global Software Systems Corp (GSS) [Likely] — IANA registry contact record echoed by web sources

Third-party aggregators

SpeedGuide, T1 Shopper restate the IANA gss-xlicen name with no independent technical detail [Likely] — https://www.speedguide.net/port.php?port=128 , http://www.t1shopper.com/tools/port-number/128/

Analyst note

legacy vendor licensing port; a responsive 128/udp today is more likely an anomaly or unrelated custom service than genuine GSS X-license traffic.