Port 916: NetInfo — The ghost in the registry

Port 916 is officially assigned. Officially unused. Officially haunted.

What Port 916 Was For

Port 916 was registered for NetInfo, an RPC-based directory service that Apple inherited from NeXT. NetInfo managed user accounts, groups, network configuration, and other administrative data across Mac networks.¹

When you logged into a Mac in the 1990s or early 2000s, NetInfo knew who you were. When you printed to a networked printer, NetInfo knew where it was. The service ran on multiple ports in the well-known range (0-1023), with port 916 among them.²

The Service That Disappeared

Apple began phasing out NetInfo in Mac OS X 10.2 (2002), replacing it with Open Directory—an LDAP-based system that followed industry standards instead of NeXT's proprietary approach.³

By Mac OS X 10.5 Leopard (2007), NetInfo was gone. Not deprecated. Not hidden. Gone. The database, the utilities (nicl, NetInfo Manager), the entire infrastructure—all removed and replaced with local Directory Services stored as XML files.⁴

The rest of the world had standardized on LDAP for directory services. Apple finally joined them.

What Happens to a Port When Its Service Dies

Port 916 remains in IANA's registry, assigned to a protocol that hasn't answered in nearly two decades. The port number can't be reassigned—it's permanently reserved for NetInfo, even though NetInfo will never use it again.

This is the Internet's version of a tombstone. The name stays in the registry. The grave stays empty.

Why This Matters

Unassigned ports exist because no one has requested them yet. Port 916 is different—it's assigned to something that existed, served a purpose, and then ceased to exist.

If you see traffic on port 916 today, it's either:

• A very old Mac that somehow still runs pre-Leopard OS X (unlikely)
• Malware using an abandoned port to hide in plain sight (more likely)
• A misconfigured service that doesn't know the protocol is dead (possible)

You can check what's listening on port 916 on your system:

# On macOS/Linux
sudo lsof -i :916
netstat -an | grep 916

# On Windows
netstat -ano | findstr :916

If something answers, it's not NetInfo.

The Well-Known Range

Port 916 falls in the well-known ports range (0-1023), reserved for services assigned by IANA. These ports require root/administrator privileges to bind to, which is why system services traditionally used them.

Getting a well-known port assigned meant your protocol was important enough to deserve a permanent, privileged spot in the Internet's infrastructure. NetInfo had that status. And then it didn't matter anymore.

What's Left

A registry entry. A number that will never answer. A reminder that protocols, like species, can go extinct.

Port 916 is the last trace of NetInfo—a directory service that knew every user on your network, and is now known by no one.