Port 3031: EPPC — Remote AppleEvents

What Port 3031 Does

Port 3031 is registered with IANA for eppc — the Remote AppleEvents Protocol. It is the network channel through which one Mac can send AppleScript commands to another Mac and receive the results.

AppleEvents is Apple's inter-process communication system. Locally, it lets one application talk to another — tell Safari to open a URL, tell Finder to move a file, tell your mail client to send a message. Remote AppleEvents extended this across a network. Port 3031 is where those messages arrive.

How It Works

The eppc protocol uses its own URL scheme: eppc://hostname/. Opening such a URL initiates a connection to the target machine on port 3031. The connection requires authentication — a username and password — before any commands are accepted.

Once authenticated, the requesting machine can send Apple Event messages to any application on the remote Mac. The remote application processes the event and sends back a result, just as it would for a local AppleScript call.

-- Control an application on a remote Mac
tell application "Finder" of machine "eppc://192.168.1.10/"
    get name of every disk
end tell

This was genuinely powerful in its time. System administrators and power users could automate fleets of Macs, run scripts remotely, and build distributed workflows without any additional software — just AppleScript and the network. ¹

The Range It Belongs To

Port 3031 sits in the registered port range: 1024–49151. These ports are not freely available — they're registered with IANA, meaning a specific organization or protocol has claimed them. They don't require root privileges to open (unlike well-known ports below 1024), but they're supposed to be used only by their registered protocol.

IANA lists port 3031 for both TCP and UDP under the service name eppc. ²

Current Status

Remote AppleEvents is largely a relic. Apple deprecated network access to AppleEvents in macOS and now discourages it. Modern Mac automation uses different channels: SSH with remote scripting, Shortcuts, or dedicated management platforms like Jamf.

More practically, Remote AppleEvents attracted security scrutiny. Because it exposes application control to the network, researchers identified it as a lateral movement vector — an attacker already inside a network could use eppc to pivot from one Mac to another if Remote Apple Events was enabled and credentials were known or guessable. ³

Apple now disables Remote Apple Events by default. You won't find port 3031 open on a modern Mac unless someone explicitly turned it on in System Settings under Sharing.

Checking What's Listening on This Port

If you see port 3031 active on a system, check what's using it:

macOS / Linux:

# Show process listening on port 3031
lsof -i :3031

# Or with ss
ss -tlnp | grep 3031

Windows:

netstat -ano | findstr :3031
tasklist /FI "PID eq <PID from above>"

On a Mac, if lsof shows /usr/libexec/rapportd or a similar Apple daemon on this port, it's likely a legitimate system process. If it's something unexpected, investigate.

Why Unoccupied Registered Ports Matter

Most of the registered range is empty. IANA has assigned only a fraction of the 48,000+ ports in the 1024–49151 range. The rest are available for applications to use informally — development servers, internal tools, local services.

This creates a quiet ambiguity: when you see an unfamiliar port open, it might be its registered protocol, it might be something informal and legitimate, or it might be something worth examining more carefully. Port numbers are not access control. Knowing the registered name is just a starting point.