Port 773: Submit and Notify — The Ghost Services

Port 773 occupies a strange place in Internet history. It has official service assignments—"submit" for TCP and "notify" for UDP—but the protocols behind those names have disappeared.

What Port 773 Was Assigned To

According to RFC 1340 published in July 1992, port 773 was assigned to two services:¹

• submit (TCP) — No description or documentation provided
• notify (UDP) — No description or documentation provided

The RFC lists the port numbers and service names, but provides no information about what these services actually did, who created them, or how they were supposed to work. No references. No contact information. Just two names.

The Well-Known Ports Range

Port 773 sits in the well-known ports range (0-1023), which is reserved for system-level services assigned by the Internet Assigned Numbers Authority (IANA).² These low-numbered ports were meant for foundational Internet protocols.

But unlike port 80 (HTTP) or port 22 (SSH), nobody remembers what port 773 was for.

What Happened to Submit and Notify

The protocols are gone. Port 773's service assignments appear in the historical record but have no living implementations. This is different from an unassigned port—port 773 was assigned to something, but that something vanished.

Some sources mention port 773 being used for "Mac OS X RPC-based services" or "NetInfo," but these references are vague and contradictory.³ There's no clear protocol specification, no active software listening on this port by default, and no standard describing how "submit" or "notify" actually worked.

The most honest answer: nobody knows what these services were supposed to do, and it doesn't matter anymore.

Security Considerations

Because port 773 has no standard service running on it, you shouldn't see traffic on this port under normal circumstances. If something is listening on port 773 on your system, it's either:

• Custom software you or someone else installed
• Malware using an obscure port to avoid detection

Some security databases note that trojans have historically used port 773 for unauthorized remote access, precisely because the port is assigned but unused.⁴ An empty port with an official assignment makes a convenient hiding place.

Checking Port 773

To see if anything is listening on port 773 on your system:

Linux/Mac:

sudo lsof -i :773
sudo netstat -tuln | grep 773

Windows:

netstat -ano | findstr :773

If nothing returns, the port is closed. If you see a process, investigate what it is—it shouldn't be there unless you put it there.

Why Ghost Ports Matter

Port 773 represents a class of assignments that exist in the registry but have no practical meaning. The Internet has thousands of these—ports assigned in the 1980s and 1990s to experimental protocols, academic projects, or commercial services that never achieved adoption.

They clutter the namespace. They create confusion. They make it harder to know which ports are genuinely reserved and which are functionally available.

But they also tell a story. Port 773 is a reminder that the Internet we have today isn't the only Internet we could have built. Somewhere in 1992, someone thought "submit" and "notify" were important enough to claim a well-known port. They were wrong, or the timing was wrong, or the world moved on.

The port number remains. The protocol is gone. The name survives in an RFC that nobody reads.

Related Ports

Unlike active service ports, port 773 has no meaningful related ports because it has no active protocol family. However, if you're investigating unusual port activity, consider checking:

• Port 135 (Microsoft RPC) — If port 773 shows activity related to Windows RPC services
• Port 111 (Sun RPC) — For Unix/Linux RPC-related traffic
• Port 587 (SMTP Submission) — The actual standard for mail submission, in case "submit" was mail-related