Port 776: wpages — The Ghost Service and the Squatter

Port 776 sits in the well-known port range (0-1023), reserved for services assigned by IANA. According to the official registry, this port belongs to a service called "wpages."¹

But here's the thing: nobody knows what wpages is. Or was.

The Official Assignment That Leads Nowhere

IANA's Service Name and Transport Protocol Port Number Registry lists port 776 as assigned to "wpages" for both TCP and UDP.¹ That's the extent of the official documentation. No RFC. No specification. No contact information. Just a name.

Search for wpages protocol documentation and you'll find nothing. No historical references. No implementation guides. No mention in technical manuals from the era when well-known ports were being claimed.

The service appears to have been registered and then vanished, leaving only its name behind in the registry.

What Actually Runs on Port 776

While wpages remains a ghost, port 776 has found actual use—particularly on Linux systems running NFS (Network File System).

The port is commonly used by rpc.statd, the Network Status Monitor RPC server.² This service handles a specific problem: what happens to file locks when an NFS server crashes and reboots?

When a client has locked a file on an NFS server and the server goes down, those locks exist in limbo. The server doesn't remember them after reboot. The client doesn't know if they're still valid. rpc.statd running on port 776 helps coordinate lock recovery—letting clients know the server has restarted so they can re-establish their locks.

This has nothing to do with wpages. It's just a service that needed a port and found one that was officially assigned but practically abandoned.

The Well-Known Port Range

Port 776 lives in the well-known port range (0-1023), which requires root privileges to bind on Unix-like systems. These ports were originally assigned by IANA to specific services to ensure consistency across the Internet.

The idea was simple: if everyone agrees that SSH lives on port 22 and HTTP lives on port 80, clients know where to connect without configuration.

But not every well-known port assignment succeeded. Some services never launched. Some were implemented but never adopted. Some were registered optimistically and then forgotten.

Port 776 appears to be one of these—a well-known port that never became well-known for its intended purpose.

The Gap Between Registry and Reality

The official assignment says "wpages." The actual use says "NFS lock recovery." This gap is common in the port number system.

Ports aren't like domain names where registration implies active use. They're more like street addresses—IANA assigns them, but what actually happens at that address depends on who moves in.

Sometimes the assigned service thrives. Sometimes it never arrives. Sometimes squatters claim the space for something entirely different.

Port 776 is the latter: a ghost service and the squatter who took its place.

Checking What's Listening

On Unix-like systems, you can see what's actually using port 776:

# See what's listening on port 776
sudo lsof -i :776

# Or using netstat
sudo netstat -tulpn | grep :776

# Or using ss (modern replacement for netstat)
sudo ss -tulpn | grep :776

If you're running NFS services, you might see rpc.statd. If you see nothing, the port is unused. If you see something unexpected—investigate. Port 776 has been observed in use by malware in the past,³ though this doesn't mean the port itself is dangerous.

Why Unassigned Ports Matter

Wait—port 776 isn't unassigned. It's assigned to wpages. But functionally, it behaves like an unassigned port because the assigned service doesn't exist.

This matters because it shows how the port system evolved. Early Internet pioneers assigned ports optimistically, sometimes before the service was fully developed. Some of those services never materialized. The ports remained assigned in the registry but empty in practice.

Modern systems handle this better. The registered port range (1024-49151) doesn't require IANA assignment for every port. Services can register ports through a lighter-weight process, and the dynamic/private range (49152-65535) is explicitly reserved for temporary use.

But the well-known port range remains full of these ghosts—services that were assigned ports in the 1980s and 1990s, then disappeared, leaving their port numbers behind like abandoned buildings.

The Squatter's Legitimacy

Is it wrong for rpc.statd to use port 776 when it's officially assigned to wpages?

Not really. If wpages doesn't exist, the port is effectively available. The alternative—letting assigned-but-unused ports sit empty forever—would be wasteful.

The Internet has always been pragmatic. Official assignments matter, but actual use matters more. Port 776 is assigned to wpages in the registry. Port 776 is used for NFS lock recovery in reality. Both statements are true. Neither invalidates the other.

This is the gap between how the Internet is documented and how it actually works.