Port 103: Genesis Point-to-Point Trans Net — The Ghost Next Door

What Runs on Port 103

Port 103 is officially assigned by IANA to a service called gppitnp, which stands for Genesis Point-to-Point Trans Net¹. The assignment covers both TCP and UDP.

If that name means nothing to you, you are not alone. There is no surviving RFC for gppitnp. There is no open-source implementation. There is no tutorial, no Stack Overflow question, no blog post explaining what it actually did. The protocol exists as a line item in the IANA registry and almost nowhere else.

What we do know: port 103 sits directly next to port 102, which is assigned to ISO-TSAP Class 0, the transport layer for X.400 messaging². This proximity is not a coincidence. Port 103 appears to have been part of the broader X.400 ecosystem, a point-to-point transport mechanism operating alongside the X.400 message handling system.

The X.400 Connection

To understand port 103, you need to understand what port 102 was carrying.

X.400 was the ITU-T standard for electronic mail, first published in 1984³. It was the "official" email system, designed by committee, backed by governments, mandated by procurement policies. While SMTP was being built by researchers sending messages to each other across ARPANET, X.400 was being drafted in conference rooms in Geneva.

X.400 was technically sophisticated. It supported delivery confirmation, message recall, encryption, and complex organizational addressing. It was also, by most accounts, brutally complex. An X.400 email address looked something like:

C=US;A=ATTMAIL;P=ORGANIZATION;O=DIVISION;S=SMITH;G=JOHN

Compare that to john@example.com.

The 1990s saw what historians of the Internet call the Protocol Wars: OSI standards (including X.400) versus the TCP/IP suite (including SMTP)⁴. SMTP won. Not because it was technically superior, but because it was simple, open, and already in use. X.400 was mandated for U.S. government use under GOSIP (Government Open Systems Interconnection Profile), and even that could not save it.

By the mid-1990s, X.400 had been abandoned by everyone except a handful of military, aviation, and EDI (Electronic Data Interchange) systems where its security features still mattered⁵.

Port 103 carried a protocol that was ancillary to this losing side. When X.400 faded, port 103 faded with it, leaving behind even less of a trace than its neighbor.

The Well-Known Port Range

Port 103 falls within the System Ports range (0-1023), also called "well-known ports"⁶. These ports are controlled by IANA and typically require elevated privileges to bind to on Unix-like systems. They represent the most carefully allocated portion of the port number space.

Being in this range means port 103 was assigned during the early era of Internet standardization, when port numbers below 1024 were reserved for protocols that the community considered important enough to enshrine. The assignment persists in the registry even though the protocol it names has, for all practical purposes, vanished.

How to Check What Is Listening on Port 103

On most modern systems, nothing will be listening on port 103. But you can verify:

Linux:

sudo ss -tlnp | grep :103

macOS:

sudo lsof -i :103

Windows:

netstat -an | findstr :103

If something is listening on port 103 and you did not put it there, investigate. Unassigned and obscure ports are occasionally used by malware specifically because they attract less scrutiny.

Why Unassigned and Forgotten Ports Matter

The Internet has 65,535 ports per transport protocol. Only a fraction carry protocols that anyone remembers. Port 103 is one of thousands that were assigned, used (maybe), and then abandoned as the protocols they served lost the evolutionary race.

These forgotten ports matter for two reasons:

For security: Obscure ports are attractive to attackers. If you are running a firewall, you should not assume that a port is safe because you have never heard of it. The fact that port 103 has been flagged in historical Trojan databases (not because the protocol itself is dangerous, but because the port was available and unmonitored) is a reminder that emptiness is not safety.

For history: Every port assignment is a record of someone, somewhere, believing a protocol was important enough to claim a number for. Genesis Point-to-Point Trans Net was important to someone. That it left almost no trace tells you something about how quickly the Internet forgets.