491
Summary
- // typical exposure
- Restricted (trusted networks only) — GraphOn's own documentation treats 491 as an internal host-to-client communications port for GO-Global and explicitly directs internet-facing client connections to port 443 instead, matching a trusted-network/Restricted posture rather than direct public exposure.
- // common applications
- GraphOn GO-Global Traffic on this port is most often GraphOn GO-Global host-to-client or internal communication traffic; GraphOn's own administrator and security-overview documentation confirms the GO-Global Host listens on TCP port 491 by default.
- // analyst note
- An open port 491 outside a known GO-Global deployment context is a fairly specific vendor fingerprint (GraphOn) worth confirming against inventory rather than assuming a generic listener; internet-facing exposure runs against the vendor's own recommendation.
- // if you see it open
- GraphOn's own Administrator and Security Overview guides direct internet-facing GO-Global deployments to use port 443 for client connections and reserve 491 for internal host-to-client traffic. No CVE is recorded for port 491 as of an August 2026 search; SANS Internet Storm Center's port-491 page shows a low/green threat level with no populated scan-volume or CVE data. No malware/trojan association was found.
About port 491/tcp.
Port 491/tcp carries GraphOn Corporation's GO-Global remote application/desktop access software, registered with IANA under the service name go-login; it should generally stay internal-only rather than be exposed directly to the public internet, per GraphOn's own guidance to route internet-facing client connections through port 443 instead.
IANA registers go-login on both 491/tcp and 491/udp, with a blank Reference field and assignee Troy Morrison. No formal RFC or IANA-cited reference document exists for this assignment, and no other IANA notes accompany the entry.
GraphOn's own administrator, security-overview, and deployment guides state that the GO-Global Host listens on "GraphOn's registered port 491" by default for host-to-client and internal communications, and instruct administrators to permit TCP 491 through firewalls for that traffic. For deployments reachable from the internet, GraphOn recommends switching client connections to port 443 and reserving 491 for internal use.
Measured prevalence from the repo's nmap-services-derived dataset: 491/tcp open-frequency ≈ 0.00005 (~0.005%), 491/udp ≈ 0.000297 (~0.03%). Both figures are very low, consistent with a niche enterprise remote-access product rather than a widely-deployed default-open service.
- IANA assignment
go-login— description "go-login"; reference (blank — no RFC cited); assignee Troy Morrison; dual-registered 491/tcp + 491/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry go-login 491/tcp- Range class
- well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry go-login 491/tcp
- Prevalence
- nmap-services open-frequency 491/tcp ≈ 0.00005 (~0.005%); 491/udp ≈ 0.000297 (~0.03%) [Confirmed] — this site's own tooling
- Related ports
- 443/tcp (GraphOn-recommended alternative for internet-facing GO-Global client connections) [Confirmed] — GraphOn Deployment Guide
Primary use
GraphOn GO-Global remote application/desktop access (application publishing) software; GO-Global Host listens on TCP 491 by default for host-to-client and internal communications [Confirmed] — https://releases.graphon.com/6.x/6.0/Documents/GO-Global_6.0_Administrator_Guide.pdf, https://releases.graphon.com/6.x/6.0/Documents/GO-Global_6.0_Security_Overview.pdf
Other/unofficial uses
none found in searches as of an August 2026 search [Unknown]
Security implications
GraphOn recommends restricting 491 to internal traffic and using port 443 for internet-facing GO-Global client connections; no CVE or malware association found as of an August 2026 search
Typically seen on
enterprise environments running GraphOn GO-Global host servers
- Analyst note
- An open port 491 outside a known GO-Global deployment context is a fairly specific vendor fingerprint (GraphOn) worth confirming against inventory rather than assuming a generic listener; internet-facing exposure runs against the vendor's own recommendation.
About port 491/udp.
Port 491/udp is registered with IANA under the service name go-login (assignee Troy Morrison) as the dual-registration companion to 491/tcp, which GraphOn Corporation's own administrator and security-overview documentation identifies as its GO-Global remote application/desktop access software — the GO-Global Host listens on TCP 491 by default for host-to-client and internal communications. No vendor documentation describes UDP-specific behavior on 491, so while the service name is now identified, any UDP traffic on this port should still be verified against a known GO-Global deployment rather than assumed.
The IANA Service Name and Transport Protocol Port Number Registry lists go-login as dual-registered on both 491/tcp and 491/udp, with the same assignee and contact (Troy Morrison) and a blank Reference field — meaning no RFC or external document was ever cited to support the registration. No registration or modification date is recorded for the entry.
Beyond GraphOn's own documentation, a search of forums and security trackers as of August 2026 found no additional confirmed application or service actively using this port, and no UDP-specific vendor or community sighting. SANS Internet Storm Center maintains a stub tracking page for port 491 but shows no populated scan-volume data and lists no CVE or threat-trend entries.
A single old SpeedGuide forum thread mentions ZoneAlarm's vsmon.exe in connection with port 491, but the page returned an error on direct fetch and could not be independently verified, so this remains an unconfirmed secondary-source mention rather than a documented sighting. No malware family or CVE is tied to this port as of an August 2026 search.
- IANA assignment
go-login— no description text beyond the service name; assignee/contact Troy Morrison; dual-registered 491/tcp + 491/udp; Reference field blank [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry go-login 491/udp- Range class
- well-known/system (0–1023) [Confirmed] — this site's own tooling
- Prevalence
- nmap-services open-frequency 491/udp ≈ 0.000297 (~0.03%); 491/tcp ≈ 0.00005 [Confirmed] — this site's own tooling
- Related ports
- 491/tcp (same
go-logindual registration; GraphOn-documented TCP default) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
Primary use
GraphOn Corporation's GO-Global remote application/desktop access (application publishing) software — the GO-Global Host listens on TCP 491 by default for host-to-client and internal communications; the UDP row is the companion of the same dual registration, and no UDP-specific vendor documentation was found [Confirmed re: TCP default and dual registration; Unknown re: UDP-specific behavior] — https://releases.graphon.com/6.x/6.0/Documents/GO-Global_6.0_Administrator_Guide.pdf, https://releases.graphon.com/6.x/6.0/Documents/GO-Global_6.0_Security_Overview.pdf
Other/unofficial uses
none confirmed; an unverified forum mention associates the name with ZoneAlarm's vsmon.exe process but could not be independently confirmed
Security implications
no confirmed malware or CVE association as of an August 2026 search; SANS ISC tracking page shows no populated scan-volume data
Typically seen on
enterprise environments running GraphOn GO-Global host servers (documented for TCP; no UDP-specific deployment pattern found)
- Analyst note
- An open port 491 is a fairly specific vendor fingerprint (GraphOn GO-Global) worth confirming against inventory rather than assuming a generic listener; no UDP-specific vendor behavior is documented, so treat UDP traffic on this port as unverified until confirmed against a known GO-Global deployment.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| go-login | UDP | — | 0.03% |
| go-login | TCP | — | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.