Port 797: Unassigned (Historically NetInfo)

What Port 797 Is

Port 797 is unassigned by IANA.¹ It sits in the well-known ports range (0-1023), reserved for system services, but has no official protocol assigned to it.

Despite being officially unassigned, port 797 appears in older documentation and network scans associated with NetInfo—Apple's now-defunct directory service used for managing administrative data on Mac OS X Server systems.²

The NetInfo Story

NetInfo was a hierarchical distributed database that managed administrative information on NeXTSTEP, OpenStep, and early Mac OS X systems. It stored user accounts, group configurations, email settings, printer definitions, and other network resources.³

NetInfo used RPC (Remote Procedure Call) for network communication and occupied various ports in the well-known range. The service was completely removed from macOS in version 10.5 Leopard, released in 2007. It was replaced by Open Directory, which had been available since Mac OS X Server 10.2.⁴

Why This Matters

Port 797 is a ghost. If you find it open during a network scan, you're looking at one of two things:

1. An ancient Mac OS X Server installation that hasn't been updated since before 2007
2. Something else entirely that happens to be using this unassigned port

The first scenario is a security problem—a nearly 20-year-old operating system shouldn't be facing the Internet. The second scenario requires investigation.

What "Unassigned" Means

The well-known ports range (0-1023) is controlled by IANA. Ports in this range require administrative privileges to bind to on Unix-like systems—this restriction exists because these ports were meant for system services that needed trust.⁵

Unassigned ports in this range are available for official assignment if someone requests one through IANA's application process. Until then, they remain empty—officially claimed by nothing, but sometimes occupied by services that predated formal registration or never bothered with it.

Port 797's association with NetInfo was never formalized. Apple used it, but never registered it. When NetInfo died, the port became a historical footnote.

How to Check What's Listening

On Linux or macOS:

# See what's listening on port 797
sudo lsof -i :797

# Or using netstat
sudo netstat -tulpn | grep :797

# Scan the port
nmap -p 797 -sV <target>

On Windows:

# Check listening ports
netstat -ano | findstr :797

# Test if the port responds
Test-NetConnection -ComputerName <target> -Port 797

If you find something listening on port 797 in 2026, investigate it. It's either very old or very custom.

Related Ports

• Port 985: NetInfo Static Port (also deprecated with NetInfo's removal)
• Port 1033: Another port historically associated with NetInfo⁶
• Ports 389/636: LDAP/LDAPS—the modern directory service protocols that replaced NetInfo's functionality