Port 798: GOLGI — The NetInfo port that died with Mac OS X

Port 798 is assigned to GOLGI, a Remote Procedure Call (RPC) service used by Apple's NetInfo—a directory service that was fundamental to Mac OS X networking until Apple discontinued it in 2007. This well-known port now sits largely unused, a numbered monument to deprecated technology.

What GOLGI Was

GOLGI was part of Mac OS X's RPC infrastructure, specifically supporting NetInfo.¹ NetInfo was Apple's directory service system that stored network and system configuration information—user accounts, network settings, mounted filesystems, and other administrative data that multiple machines needed to share.

The service name "GOLGI" likely references the Golgi apparatus—the cellular organelle that processes and packages proteins for distribution throughout a cell. The metaphor fits: NetInfo processed and distributed directory information throughout a network of Mac machines.

The NetInfo Era

In the early Mac OS X era (roughly 2001-2007), NetInfo was how Macs found each other and shared configuration data. Port 798 was one of several ports in the 600-1023 range used by Mac OS X RPC-based services.² If you were running a Mac network in 2005, port 798 traffic was happening in the background, invisible but essential.

Then Apple killed NetInfo. Mac OS X 10.5 (Leopard) in 2007 replaced it with Directory Services, which later became Open Directory. Port 798's primary reason for existence vanished.

Why This Port Still Exists

Port 798 remains assigned in IANA's registry even though NetInfo is long dead. This is normal. The Internet doesn't delete port assignments just because the original service disappeared. The number stays reserved to prevent conflicts if old systems still exist somewhere, running NetInfo on ancient Mac OS X installations.

This is the Internet's archaeology—numbered doors that once opened to busy services, now mostly closed because the services themselves are extinct.

What Might Be Using It Now

In 2026, port 798 is likely not carrying much traffic. You might find it open in these scenarios:

• Ancient Mac installations — A Mac OS X 10.4 or earlier system that was never upgraded and is still running NetInfo
• Legacy enterprise networks — Organizations that froze their Mac infrastructure in the mid-2000s
• Malware or custom services — Since the port is well-known but rarely monitored, someone might repurpose it for something else entirely

If you find port 798 open on a modern system, it's worth investigating. It shouldn't be there.

How to Check What's Listening

On any Unix-like system:

# See if anything is listening on port 798
sudo lsof -i :798

# Or using netstat
netstat -an | grep 798

On modern macOS, you almost certainly won't find anything. On a vintage Mac OS X system from 2005, you'd see NetInfo's RPC processes.

The Well-Known Ports Range

Port 798 sits in the well-known ports range (0-1023), which means:

• Only privileged processes can bind to it (requires root/administrator access)
• It was assigned by IANA for a specific service
• It represents the early Internet's attempt to create order—every important service gets its own number in the first 1024 slots

Many ports in this range are now obsolete. The Internet moved on, but the numbers remain, reserved for services that no longer exist.

Security Considerations

If you're running a firewall, port 798 should almost certainly be blocked for incoming connections unless you specifically know you need it (you don't). There's no legitimate reason for modern systems to accept GOLGI connections.

If you see unexpected traffic on port 798:

• Investigate immediately—it's likely either misconfiguration or malicious activity
• Legacy Mac systems shouldn't be exposed to the Internet anyway
• Modern macOS doesn't use this port at all

Related Ports

Other ports in Apple's historical RPC range:

• Port 985 — NetInfo Static Port (also obsolete)
• Port 1033 — NetInfo Alternative Port (also obsolete)

These ports tell the same story: Apple's directory service infrastructure from the Mac OS X era, all deprecated when NetInfo died.

The Takeaway

Port 798 is a ghost. It carried something important once—Apple's directory service infrastructure that let Mac networks function. When NetInfo died, the port became a historical marker. The number stays assigned, but the traffic is gone.

This is normal on the Internet. Services get created, assigned port numbers, then disappear when better solutions arrive. The port numbers remain, reserved indefinitely, reminders that the Internet has a longer memory than the services that use it.