Port 835 — The ghost of NetInfo

Port 835 exists in a peculiar state: it sits in the well-known port range, was historically used by Apple, but was never officially assigned by IANA. Today, it's essentially abandoned.

What Port 835 Was Used For

Port 835 was used by NetInfo, a directory service that shipped with Mac OS X.¹ NetInfo was part of Apple's RPC (Remote Procedure Call) infrastructure and handled things like user account information, network configuration, and other system directory data on older Mac systems.

The problem? NetInfo was deprecated in Mac OS X 10.5 Leopard (released in 2007) and completely removed in later versions. Apple moved to Open Directory and standard LDAP-based services instead.

The Well-Known Port Range

Port 835 falls in the well-known port range (0-1023), which is supposed to be controlled by IANA and reserved for standard Internet services. These ports require root privileges to bind to on Unix-like systems.

Despite being in this range, port 835 was never officially assigned by IANA.² It was simply used by Apple without formal registration—common practice in the early days of computing, but increasingly rare as the Internet matured.

Current Status

Port 835 is effectively dead. Modern macOS systems don't use it. It's not assigned to any active service. It exists in that strange category of ports that were once claimed by someone but never formalized.

If you see traffic on port 835 today, it's either:

• An extremely old Mac OS X system (pre-10.5)
• Malware or scanning activity exploiting the fact that people assume old ports are "safe"
• A misconfigured service accidentally bound to this port

How to Check What's Using Port 835

On Unix-like systems (Linux, macOS, BSD):

# Check if anything is listening on port 835
sudo lsof -i :835

# Or use netstat
sudo netstat -an | grep :835

# Or use ss (on Linux)
ss -tuln | grep :835

On Windows:

# Check listening ports
netstat -an | findstr :835

If something is listening on port 835 on a modern system, investigate it. It shouldn't be there.

Why Unassigned Ports Matter

The Internet has 65,535 ports per protocol (TCP and UDP). Not all of them are assigned. In fact, most aren't.

Port assignments matter because they prevent conflicts. When everyone agrees that port 80 is HTTP and port 443 is HTTPS, applications can find each other without coordination. But unassigned ports serve a purpose too—they're available for:

• Private services that don't need Internet-wide coordination
• Dynamic allocation where applications request any available port
• Future protocols that need a permanent home

The well-known range (0-1023) is mostly full. The registered range (1024-49151) has thousands of assignments. The dynamic range (49152-65535) is deliberately kept unassigned for temporary use.

Port 835's status as an unofficial, now-abandoned port shows what happens when services claim ports without formal process. The port becomes unusable for future services because someone might still have an old system that expects NetInfo there. But it's also not officially registered, so there's no documentation, no RFC, no clear owner.

It's a ghost port. Reserved by history, but not by record.

Related Ports

Other Apple NetInfo-related ports from the same era:

• Port 600-1023 — Used by various Mac OS X RPC-based services
• Port 985 — NetInfo Static Port (also largely obsolete)

Modern Apple directory services use:

• Port 389 — LDAP (Lightweight Directory Access Protocol)
• Port 636 — LDAPS (LDAP over SSL)