Port 1971: Netop School — The Classroom That Watches Back

What Port 1971 Does

Port 1971 is registered with IANA for Netop School (also listed as "Netop Business Solutions - Netop School"), a classroom management platform developed by Danware, later Netop Business Solutions.

The software runs on both TCP and UDP. TCP handles the reliable stuff: commands, control messages, session management. UDP handles the broadcast-style communications that make sense when you're talking to 30 student machines simultaneously.

What Netop School Actually Is

Netop School is software that gives teachers superpowers over the machines in their classroom. From the teacher console, an instructor can:

• See every student's screen in real time, tiled like a grid of windows into 30 separate worlds
• Broadcast their own screen to all students at once
• Lock student machines ("put down your tools, pay attention")
• Transfer files to every computer simultaneously
• Remotely take control of a student's machine

It's legitimate software, widely deployed in schools and training facilities. The teacher's machine listens or connects on port 1971, and the student machines respond.

Netop School has since evolved into Netop Vision Pro, now marketed by Impero Software, but port 1971 remains its registered home in the IANA registry.¹

The Security Wrinkle

The same capabilities that make Netop School useful to teachers make port 1971 interesting to attackers.

Backdoor.Bifrose, a Windows remote access trojan documented by Symantec, uses port 1971 as one of its communication channels.² The parallel is not subtle: Bifrose wants to do exactly what Netop School does, just without the teacher's permission slip.

Faronics Deep Freeze, a workstation protection tool that freezes a machine's OS state so every reboot wipes changes, also uses port 1971 (or 7725) for its management communications.³

If you find port 1971 open on a machine that isn't running educational software, that's worth investigating.

How to Check What's Listening on Port 1971

On macOS or Linux:

sudo lsof -i :1971
sudo ss -tlnp | grep 1971

On Windows:

netstat -ano | findstr :1971

Then take the PID from the output and look it up:

tasklist | findstr <PID>

If you see something you don't recognize, that's your next question to answer.

Port Range Context

Port 1971 sits in the registered ports range (1024-49151). These ports are not reserved for operating system use (that's 0-1023, the well-known ports), but they are tracked by IANA. Anyone can request a registered port assignment for a legitimate service, and thousands of applications have done exactly that.

"Registered" doesn't mean the port is always in use. It means IANA has a record that someone claimed it for a specific purpose. On any given machine, port 1971 is almost certainly closed unless Netop School or Deep Freeze is actually running.