Port 2997: REBOL/IOS — The Internet Operating System That Came First

What This Port Does

Port 2997 (TCP and UDP) is registered to REBOL/IOS — the Internet Operating System component of the REBOL language platform. When an IOS Link client needed to connect to an IOS server, it knocked on port 2997.

REBOL/IOS is no longer in active development, which means you're unlikely to encounter legitimate traffic on this port today. If something is listening here on your system, it warrants investigation.

The Story

Carl Sassenrath gave personal computers multitasking in 1985 when he wrote the kernel for the Commodore Amiga's operating system. Then, in 1996, he looked at the web — at Java and Perl and the chaos of incompatible systems — and had a different idea.¹

He wanted a language that was also a data format. A runtime that was also a protocol. Something lightweight enough to run everywhere and expressive enough to replace the stack of technologies that had piled up around the Internet. He called it REBOL: the Relative Expression-Based Object Language.

REBOL shipped in 1997. REBOL Technologies was founded in 1998. And then Sassenrath built REBOL/IOS — a "common layer that spans 44 different OS/hardware systems" — an Internet Operating System that let REBOL applications run consistently across any machine on the network.²

Port 2997 was the entry point for IOS clients connecting to IOS servers. The vision was a unified distributed computing environment, built on a language that treated code and data as interchangeable.

It didn't take over the world. But the idea it described — a runtime layer abstracted from the underlying OS, running distributed applications across the network — became the cloud.

REBOL/IOS arrived in 2001, about a decade before that language existed.

The Port Range

Port 2997 sits in the registered ports range (1024–49151). These ports aren't reserved by the operating system the way well-known ports (0–1023) are — any process can bind them without elevated privileges. But they're registered with IANA, which means a specific service has formally claimed the number.³

Registered doesn't mean active. Many registered ports belong to software that peaked in the early 2000s, got abandoned, and left their port numbers behind like forwarding addresses for companies that moved.

Check What's Listening

To see if anything is using port 2997 on your system:

macOS / Linux:

# Show what's listening on port 2997
sudo lsof -i :2997

# Or with ss (Linux)
ss -tlnp sport = :2997

Windows:

netstat -ano | findstr :2997

If you see something unexpected, match the process ID against your running processes. Unknown listeners on registered ports — especially ones tied to dormant 2000s-era software — can be a sign of misconfiguration or something worse.