Port 1677: Novell GroupWise — The Ghost of Enterprise Email

What This Port Does

Port 1677 has no official IANA assignment, but in practice it belongs to Novell GroupWise.

GroupWise is an enterprise email, calendaring, and collaboration platform. Its Post Office Agent (POA) — the server-side component that manages mailboxes and delivers messages — listens on port 1677 by default. GroupWise clients connect here to send and receive email, access calendars, and manage tasks.

This is a TCP port. The connection is persistent: once a GroupWise client establishes its session on port 1677, it stays connected rather than opening new connections for each operation.

The Registered Port Range

Port 1677 falls in the registered ports range (1024–49151). IANA maintains this range to assign ports to specific applications and protocols, reducing collisions between different software.

The catch: IANA's registry and real-world usage don't always match. Novell chose 1677 for GroupWise without registering it, and the port became associated with GroupWise through decades of deployment rather than official assignment. Today IANA lists it as unassigned, but if you're a network administrator and you see port 1677 open, you know what's there.

GroupWise and Port 1677

Novell GroupWise was the enterprise email system of the pre-Exchange era. Through the 1990s and into the 2000s, large organizations — governments, healthcare systems, banks, universities — ran their internal communications on GroupWise. At its peak it had tens of millions of users.

Port 1677 was GroupWise's default for client/server access mode. The Post Office Agent had to have a POA running on port 1677 to function as a GroupWise name server — the component that tells clients where to find their mailboxes. Without a POA on 1677, name resolution broke.

GroupWise lost the enterprise market to Microsoft Exchange and Office 365, but it didn't disappear. Micro Focus (which acquired Novell's products) still develops and supports it. Some organizations have been running GroupWise continuously since the 1990s and have no immediate plans to change. Their port 1677 traffic has been flowing for thirty years.¹

Security Considerations

If you discover port 1677 open on a system:

• Exposure risk: GroupWise clients connect directly to this port. If it's exposed to the Internet rather than restricted to internal networks, the Post Office Agent is reachable by anyone.
• Legacy software concerns: Organizations still running GroupWise are often running infrastructure that hasn't been updated in years. Legacy software accumulates unpatched vulnerabilities.
• Firewall it: Port 1677 should only be accessible from GroupWise client networks. There's no reason for it to be publicly reachable.

How to Check What's Listening

# Linux/macOS - check if anything is listening on 1677
ss -tlnp | grep 1677

# Or with lsof
lsof -i :1677

# Windows - check what process is using the port
netstat -ano | findstr :1677

If you find a process listening on 1677 on a system you don't recognize, check the process name. GroupWise's Post Office Agent process (gwpoa) is a clear signal. Anything else is worth investigating.

Why Unassigned Ports Matter

The registered port range has 48,128 slots. IANA has assigned most of the well-known ones, but plenty of ports remain technically unassigned even as real software uses them. Port 1677 is a good example: the official registry says "unassigned," but decades of GroupWise deployments mean the port has a real identity.

This matters for network administrators writing firewall rules, security teams doing port scans, and anyone trying to understand what's running on a system. "Unassigned" doesn't mean "unused" — it means the registry doesn't reflect reality.