TCP 1604

ProtocolTCP
Port1604
LabelsDarkComet remote administration tool (RAT)

Synopsis

  • TCP port 1604 is used by the Citrix ICA Browser service in legacy Citrix environments (e.g., Citrix WinFrame, MetaFrame 1.8/XP, Presentation Server 3.0/4.0/4.5, and XenApp 5).
  • This service handles server/app discovery and browser elections for older Citrix Program Neighborhood clients and many legacy thin clients, before the actual ICA session is established on 1494/TCP (or 2598/TCP with Session Reliability).
  • In real deployments, Windows servers running Citrix MetaFrame/Presentation Server/XenApp would listen on 1604/TCP (and 1604/UDP) to let clients enumerate published applications in a farm.
  • Modern Citrix stacks (StoreFront/Workspace app) typically disable this in favor of the Citrix XML Service and do not rely on 1604/TCP.
  • Historically, exposing the ICA Browser service externally has enabled enumeration of Citrix servers/apps, so best practice is to restrict or block this port.

Observed activity

Last 30 days Detailed chart

More information