Port 937: NetInfo — The ghost in Apple's directory

The Ghost Port

Port 937 is officially unassigned by IANA. But it carries history—it was used by NetInfo, a directory service that managed user accounts, groups, and system configuration in Mac OS X.¹²

NetInfo doesn't exist anymore. Apple removed it completely in Mac OS X 10.5 Leopard, released in 2007, replacing it with Open Directory.³⁴ Yet port 937 remains in the well-known range, reserved but unused—a digital placeholder for something that once mattered.

What NetInfo Was

NetInfo was Apple's hierarchical distributed database for administrative data. It stored everything the operating system needed to know about users, groups, printers, network filesystems, and other resources.⁵

Instead of scattering configuration data across multiple UNIX text files (/etc/passwd, /etc/group, etc.), NetInfo consolidated everything into a unified database that could be queried and distributed across networks. When a process needed to know a user's home directory or shell, it asked NetInfo.⁵

NetInfo inherited this architecture from NeXTSTEP—the operating system Steve Jobs built at NeXT Computer in the 1980s. When Apple acquired NeXT in 1997 and built Mac OS X on top of NeXTSTEP's foundation, NetInfo came along for the ride.

The RPC Port Range

Port 937 sits within the range 600-1023, which Mac OS X used for RPC-based services.² NetInfo communicated using Sun Microsystems' Remote Procedure Call (RPC) protocol, allowing directory queries across networks.

Multiple ports in this range could be used dynamically by NetInfo, depending on how the RPC port mapper assigned them. Port 937 was one of several ports NetInfo might bind to when handling directory service requests.

Why It Died

NetInfo was powerful but complex. Editing directory information required specialized tools like NetInfo Manager, and the hierarchical structure could be difficult to troubleshoot. More importantly, it wasn't compatible with industry-standard directory services like LDAP.

In Mac OS X 10.5 Leopard, Apple replaced NetInfo entirely with Open Directory, which used LDAP-compatible backends and stored local account data in XML property list files under /var/db/dslocal/nodes/Default/.³⁴ The Directory Access and NetInfo Manager utilities were merged into a single Directory Utility tool.

NetInfo's RPC-based architecture disappeared, and ports like 937 were no longer needed.

What This Port Means Now

Port 937 is unassigned. If you see traffic on this port today, it's either:

• A very old Mac OS X system (10.4 Tiger or earlier) still running NetInfo
• Unofficial use by some other service
• Scanning or probing by security tools checking for legacy services

To check what's listening on port 937:

# On Linux/macOS
sudo lsof -i :937

# Or using netstat
netstat -an | grep 937

Most likely, you'll find nothing. The port sits empty, waiting for a service that will never return.

The Unassigned Space

Port 937 belongs to the well-known port range (0-1023), which requires root privileges to bind to on UNIX-like systems. These ports are assigned by IANA to fundamental Internet services—HTTP on 80, HTTPS on 443, SSH on 22.

But many well-known ports remain unassigned. Some were reserved for services that never gained widespread adoption. Others, like 937, were used informally by specific vendors but never officially registered. Still others sit empty, held in reserve for future protocols that might need them.

The unassigned ports in the well-known range represent potential—space reserved for services important enough to deserve privileged port numbers, but not yet claimed. Port 937 is different. It represents the opposite: space that was used, then abandoned. A service that was important to Apple's operating system, but not important enough to survive.