Port 998: Busboy and Puparp — The assigned port nobody uses

Port 998 is officially assigned. According to IANA records, TCP port 998 belongs to a service called "busboy" and UDP port 998 belongs to "puparp."¹²

But here's the reality: almost no one knows what these services actually do. The assignments exist in the registry, but the protocols themselves have vanished from practical use.

What Is Port 998?

Port 998 sits in the System Ports range (0-1023), which means it's supposed to be reserved for well-known services assigned by IANA. Unlike ports 80 (HTTP) or 443 (HTTPS), which everyone uses every day, port 998 is a ghost—technically assigned, practically abandoned.

TCP port 998 is registered to "busboy"—a service with almost no available documentation. Old mailing lists from 2004 show network administrators finding it listening on their systems and wondering what it was.³ That's not reassuring.

UDP port 998 is registered to "puparp"—equally mysterious, equally undocumented.⁴

Both names appear in port databases and registry listings, but you won't find RFCs explaining them. You won't find active communities using them. They exist as entries in a list, nothing more.

Why Port 998 Matters (Sort Of)

Port 998 represents a strange category: assigned but unused. It's not unassigned (IANA has names on file). It's not actively used (try to find someone running busboy or puparp). It's in limbo.

This matters because:

1. The port number is technically taken — IANA won't reassign it to something else
2. But nothing meaningful uses it — You're unlikely to encounter legitimate traffic here
3. Which makes it suspicious — Some sources flag port 998 as having been used by trojans or malware in the past, precisely because it's an assigned port that nobody monitors⁵

If you find something listening on port 998, it's worth investigating. It's probably not busboy or puparp—because nobody knows what those are.

Checking What's Listening on Port 998

On Linux or macOS:

# See what's using port 998
sudo lsof -i :998

# Or use netstat
sudo netstat -tulpn | grep :998

On Windows:

# Check port 998
netstat -ano | findstr :998

If something is listening, figure out what it is. It's probably not a legitimate well-known service.

The Honest Truth About Obscure Ports

The Internet has 65,535 possible port numbers. Some carry the entire web (443). Some carry email that's been flowing since the 1980s (25). Some, like port 998, are officially assigned but practically forgotten.

These ports remind us that the registry is a historical document as much as a current map. Protocols get designed, assigned a number, and then disappear when nobody uses them. The number stays reserved. The purpose fades.

Port 998 is a placeholder. A name without a service. An address where nobody lives anymore.