Port 761: rxe — The ghost in the registry

Port 761 is officially assigned to a service called "rxe" by the Internet Assigned Numbers Authority (IANA).¹ The problem? Nobody seems to know what rxe actually is—or was.

The Mystery of rxe

Search for documentation about rxe. Search for software that uses port 761. Search for RFCs, vendor documentation, or deployment guides. You'll find almost nothing.

Port 761 exists in the official registry. It's classified as a well-known port (the range from 0-1023 reserved for standardized services). But unlike SSH on port 22 or HTTPS on port 443—ports whose purposes are universally understood—port 761's assignment to "rxe" tells us almost nothing.²

Some sources mention connections to Mac OS X RPC-based services like NetInfo, which used various ports in the 600-1023 range for remote procedure calls.³ But NetInfo itself was deprecated by Apple over a decade ago, replaced by different directory services.

What Well-Known Ports Mean

Port 761 lives in the well-known port range (0-1023). This range is special:

• Requires privileges — On Unix-like systems, only privileged processes can bind to these ports
• Globally coordinated — IANA assigns these numbers to prevent conflicts
• Intended for standards — These ports are meant for protocols everyone uses

The well-known range was created when the Internet was smaller, when a central authority could reasonably assign unique numbers to every important service. Port 761 received its assignment during that era—and then the service apparently disappeared.

Ghost Ports

Port 761 is what you might call a ghost port. The assignment exists. The number is reserved. But the service is gone—if it ever really existed in widespread use.

The Internet is full of these ghosts. Ports assigned to services that never achieved adoption, or to proprietary systems that vanished when their companies failed, or to experimental protocols that were abandoned. The registry preserves their numbers like tombstones.

Security Note

Because port 761 has no widely-known legitimate use, seeing traffic on this port should raise questions. Some malware has historically used obscure or abandoned well-known ports specifically because they're unexpected.⁴

If you see port 761 listening on your system, investigate:

# Check what's listening on port 761
sudo lsof -i :761

# Or using netstat
sudo netstat -tulpn | grep :761

# On Windows
netstat -ano | findstr :761

An open port 761 isn't automatically malicious—it could be legacy software or something legitimately using an obscure service. But it's unusual enough to warrant investigation.

Why Keep Dead Assignments?

You might wonder: if rxe isn't used, why not free up port 761?

The registry preserves these assignments because removing them could cause problems. Somewhere, maybe, old software might still expect port 761 to mean rxe. Reassigning it could create conflicts. So the number stays reserved, even though the service is effectively dead.

The Lesson of Port 761

Port 761 teaches us something about the Internet: it remembers. Every assignment, every protocol, every decision made decades ago leaves traces. Some ports carry billions of packets per second. Others sit silent, reserved for services nobody recalls.

Port 761 is the latter. A number in a database. A ghost in the registry. A reminder that not every well-known port lives up to the name.