Port 609: npmp-trap — A NetInfo ghost

Port 609 carries npmp-trap, one of several ports assigned to Apple's NetInfo system—a hierarchical distributed database that managed administrative data in NeXTSTEP and early Mac OS X. The protocol hasn't been used since 2007, but the port assignment remains.

What NetInfo Was

NetInfo was Apple's network directory service, introduced in NeXTSTEP 0.9 in 1988. It replaced Unix system configuration files and Sun Microsystems' Network Information Service (Yellow Pages) on NeXT computers.¹

NetInfo stored administrative data: user accounts, group configurations, email settings, NFS mounts, printer definitions, and other network resources. Instead of scattered configuration files, everything lived in one hierarchical database.

The npmp-trap protocol on port 609 was part of NetInfo's RPC-based (Remote Procedure Call) communication system. It worked alongside npmp-local on port 610—together they handled NetInfo's network directory operations.²

Why It Stopped Existing

NetInfo had a fundamental problem: DNS queries went through NetInfo. Basic tasks like translating a Unix UID to a username could stall because NetInfo was stuck on a DNS lookup. The system could hang waiting on itself.³

Apple began replacing NetInfo with Open Directory in Mac OS X Server 10.2 Jaguar (2002). By Mac OS X Leopard (10.5) in 2007, NetInfo was completely phased out. Open Directory used standard-based directory services instead of NetInfo's proprietary approach.³

NetInfo was replaced by a local search node called dslocal, which uses standard property list files in /var/db/dslocal/. No more custom RPC protocols. No more port 609.

What the Port Does Now

Nothing, usually.

Port 609 remains officially registered to npmp-trap in IANA's registry,⁴ but the service it was designed for no longer exists. If you find something listening on port 609, it's either:

• Legacy software that hasn't been updated since before 2007
• Malware using an abandoned port number
• A completely unrelated service that chose to use this port unofficially

To check what's listening on port 609:

# On Linux/Mac
sudo lsof -i :609
sudo netstat -tulpn | grep :609

# On Windows
netstat -ano | findstr :609

If nothing appears, the port is closed—which is the expected state on modern systems.

Why This Port Matters

Port 609 is a monument to obsolete infrastructure. It was assigned to a system that Apple built, shipped with millions of computers, and then completely replaced with something better.

The port number remains registered because IANA doesn't reclaim well-known port assignments just because the service died. Once assigned, these numbers stay in the record—a permanent reminder that the protocols we depend on today might be abandoned tomorrow.

NetInfo solved real problems in 1988. By 2007, it created more problems than it solved. The port survives, even though the protocol doesn't.

Related Ports

• Port 610 — npmp-local, NetInfo's companion protocol (also obsolete)
• Port 162 — SNMP trap, the standard protocol for network management traps
• Port 389 — LDAP, the directory service protocol that Open Directory actually uses