41
Summary
- // if you see it open
- Not a notable scan target; absent from current high-volume scan-port lists (2024–2025). Some secondary port-database sites flag 41/tcp as the 'Deep Throat' remote-access trojan, but primary trojan-port references list Deep Throat on 2140/3150/6670/6771, not 41 — that association is unconfirmed and should not be asserted. A responsive port 41 is statistically rare and best treated as scan residue, a decoy, or a misconfiguration. Default-deny is the standard firewall stance.
- // analyst note
- Port 41 carries an IANA name but no live protocol and effectively zero legitimate traffic — treat a responsive port 41 as noise or anomaly and investigate rather than assume a service.
About port 41/tcp.
Port 41/tcp is registered with IANA under the service name graphics, description "Graphics," and a dual registration on TCP and UDP; every other column in the IANA registry row — assignee, contact, registration date, modification date, and reference — is blank, so there is no RFC cited in the IANA registry for this entry. The name is a fossil from the earliest assigned-numbers documents: RFC 1010 ("Assigned Numbers," May 1987) lists 41 GRAPHICS Graphics Protocol in its port-number table, an early experimental intent to carry device-independent graphic data over TCP/IP. No protocol specification or RFC ever defined a wire format for it, no standard was deployed, and no software product is documented as implementing the graphics service. Modern graphics, imaging, and media transport runs over application-layer protocols — HTTP(S), RTP, WebRTC — not a dedicated low port. For an analyst, port 41 is effectively dead space: nmap-services records an open-frequency of 0.000000 for 41/tcp (never observed open in that dataset) and 0.000445 for 41/udp, so a responsive port 41 is statistically rare and worth treating as residual scan noise, a decoy, or a misconfiguration rather than a normal service. Some secondary port-database sites flag 41/tcp as the "Deep Throat" remote-access trojan, but primary trojan-port references list Deep Throat on 2140/3150/6670/6771, not 41 — that association is unconfirmed and should not be asserted. Any firewall stance for port 41 in a typical environment is a default deny; no exception is warranted.
- IANA assignment
graphics— "Graphics"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 41/tcp + 41/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry / the IANA Service Name and Transport Protocol Port Number Registry (lines 89–90)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 41/tcp = 0.000000 (never observed open in that dataset); 41/udp = 0.000445 [Confirmed] — https://svn.nmap.org/nmap/nmap-services
- Registration date
- Unknown — the IANA CSV records no registration or modification date; RFC 1010 (May 1987) establishes the slot was in use by 1987, but that is a historical document date, not an IANA registration date [Confirmed-unknown] — IANA CSV; RFC 1010
- Related ports
- surrounding low ports rlp 39 (Resource Location Protocol) and name/nameserver 42 (Host Name Server); the small-services neighborhood generally
Primary use
historical "Graphics Protocol" — early experimental intent to exchange device-independent graphic data; never specified or deployed
41 GRAPHICS Graphics ProtocolOther/unofficial uses
none documented; no known software implements the graphics service
Security implications
not a notable scan target; absent from current (2024–2025) high-volume scan-port lists. A legacy "Deep Throat" trojan association appears on some secondary port-database sites but is contradicted by primary trojan-port references (Deep Throat documented on 2140/3150/6670/6771) — unconfirmed, do not assert
Typically seen on
nothing in normal operation; an open port 41 is an anomaly (scan residue, decoy, or misconfiguration)
- Analyst note
- Port 41 carries an IANA name but no live protocol and effectively zero legitimate traffic — treat a responsive port 41 as noise or anomaly and investigate rather than assume a service.
About port 41/udp.
Port 41/udp is registered with IANA as graphics with the description "Graphics" and a blank reference field — no RFC, assignee, contact, registration date, or modification date is recorded for the entry, and it is dual-registered identically on both TCP and UDP (41/tcp carries the same graphics/"Graphics" pair). Unlike a port whose meaning is pinned by a specification, port 41 is a bare historical reservation: the name dates to early-internet-era allocations and was never backed by a published protocol, so there is no canonical wire format to describe and the service never saw real-world deployment. For an analyst this makes 41/udp effectively a "dead" well-known port — no legitimate modern software is known to bind it, and the IANA assignment survives only for historical continuity. What documented security interest exists attaches to the TCP side, not UDP: port 41/tcp has a long-standing reputation as a default port for the late-1990s/early-2000s Windows backdoors DeepThroat and Foreplay (RATs targeting Windows 9x/NT), which are TCP-based and effectively extinct on current systems; no malware was found that specifically uses 41/udp. SANS Internet Storm Center telemetry shows only low, ongoing background-noise scanning against port 41 with no elevated threat rating, consistent with routine internet reconnaissance rather than a targeted campaign. Because the port has no legitimate active use, any inbound traffic to 41/udp on a production host is anomalous and worth investigating; standard firewall practice is simply to drop it. The honest summary is that 41/udp is a legacy IANA reservation with a blank reference, no live protocol, and no known modern software — the malware lore belongs to TCP and is itself historical.
- IANA assignment
graphics— "Graphics"; reference (blank — no RFC cited in IANA registry); assignee (blank), contact (blank), registration date (blank); dual-registered 41/tcp + 41/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 90)- Range class
- well-known (0–1023)
- Prevalence
- nmap-services observed open-frequency 41/udp ≈ 0.000445 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 41/tcp row carries a frequency of 0 — never observed open in that sample, so what little activity the port number shows sits on the UDP side[Confirmed] — nmap-services dataset
- Related ports
- contrast the small-services cluster (7, 9, 11, 13, 17, 19, 37); the TCP counterpart 41/tcp shares the same IANA name and carries the DeepThroat/Foreplay history
Primary use
none in practice — a historical/legacy IANA name ("Graphics") with no published protocol or RFC backing it; never widely deployed and considered obsolete [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml, https://whatportis.com/ports/41_graphics
Other/unofficial uses
no known legitimate software binds 41/udp; the malware association (DeepThroat / Foreplay RATs) is TCP-specific and historical, not UDP
Security implications
SANS ISC shows low, ongoing reconnaissance scanning of port 41 with no elevated threat level (green) as of mid-2026 — routine internet background noise; because the port has no legitimate active use, any 41/udp inbound on a production host is anomalous and warrants investigation; drop at the firewall
Typically seen on
nothing legitimate; inbound 41/udp on a production host is an anomaly / possible scan or backdoor
- Analyst note
- 41/udp is a legacy IANA reservation with a blank reference and no live protocol — treat any traffic as anomalous; the DeepThroat/Foreplay malware lore is TCP-side and effectively extinct.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| graphics | UDP | — | 0.04% |
| graphics | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.