Port 741: netGW — The ghost of NetInfo

Port 741 is officially assigned to netGW (Network Gateway), a service that was part of NetInfo—Mac OS X's directory service in the early 2000s. Both TCP and UDP protocols use this port.

What NetInfo Was

NetInfo was a hierarchical distributed database inherited from NeXTSTEP. It stored administrative information: user accounts, group memberships, printer configurations, mounted filesystems, and network services. Think of it as a centralized way for processes on your Mac to ask "who are the users on this machine?" or "what printers are available?"¹

The netGW service on port 741 was part of the RPC (Remote Procedure Call) infrastructure that allowed NetInfo to communicate across the network.²

The Problem: This Service Is Dead

NetInfo was completely removed from Mac OS X in version 10.5 (Leopard), released in 2007. Apple replaced it with Open Directory, which had been available since Mac OS X Server 10.2.³

So port 741 is assigned to a service that hasn't existed for nearly two decades. The registration remains, but the software that used it is gone.

Security Note

Because port 741 is a well-known port that's rarely used in modern systems, it has been exploited by malware. Some trojans have used this port for communication precisely because it's assigned but dormant—less likely to raise suspicion than a random high port.⁴

If you see traffic on port 741 today, investigate it. It shouldn't be there unless you're running extremely old Mac OS X systems (pre-10.5).

Well-Known Ports and Obsolescence

Port 741 sits in the well-known range (0-1023), which means IANA officially assigned it. These ports were meant for system services that would run consistently across the Internet.

But protocols evolve. Services get replaced. NetInfo became Open Directory. The port number remains reserved, a ghost in the registry.

This is what happens to infrastructure: the registration outlives the service. Port 741 is a monument to deprecated technology.

How to Check What's Listening

On Unix-like systems (Linux, macOS):

# See what's listening on port 741
sudo lsof -i :741
sudo netstat -an | grep 741

# Check for both TCP and UDP
ss -tulpn | grep 741

On Windows:

netstat -ano | findstr :741

If nothing appears, the port is closed—which is what you should see on any modern system.