Port 121: ERPC — The Ghost Protocol of a Parallel Computing Dream

Port 121 is assigned to ERPC: the Encore Expedited Remote Procedure Call. If you've never heard of it, that's because the company that built it, the machines it ran on, and the protocol itself have all been gone for over two decades. But the port reservation remains in the IANA registry, a permanent record of a parallel computing dream that didn't survive the 1990s.

What ERPC Was

ERPC stood for Expedited Remote Procedure Call. The "expedited" part was the point. Standard RPC, the mechanism that lets one computer call a function on another computer as if it were local, was too slow for what Encore Computer Corporation was building. Their machines had multiple processors sharing memory, and the communication between them needed to be fast. ERPC was their answer: a stripped-down, lower-latency variant of RPC designed for tightly coupled parallel systems.¹

The protocol was originally developed by a company called Hydra Computer Systems, Inc. The functional specification, version 1.04, was written by J. Taylor in July 1984.² Within months, Hydra was acquired by Encore, and the protocol became part of Encore's ecosystem.

Port 121 was registered in the IANA port number registry, documented in RFC 1010 under the name "ERPC HYDRA Expedited Remote Procedure Call."² Later editions of the Assigned Numbers RFC dropped the Hydra name and listed it simply as "Encore Expedited Remote Pro.Call," attributed to Jack O'Neil.³

The Story Behind the Port

Encore Computer Corporation was founded in 1983 by three people who had already shaped the computer industry. Kenneth Fisher had built Prime Computer from a $7 million company into a $350 million one. C. Gordon Bell had led the development of the VAX at Digital Equipment Corporation. Henry Burkhardt III had co-founded Data General.⁴

They raised nearly $50 million to build something ambitious: massively parallel machines from commodity processors. They hired technical staff from Carnegie Mellon's research labs, set up headquarters in Wellesley Hills, Massachusetts, and started acquiring companies. Hydra Computer Systems for processors. Foundation Computer Systems for software. Resolution Systems for terminals.⁴

Their first machine, the Multimax, shipped in September 1985. It was one of the first commercial systems to use bus snooping, a technique that let multiple processors share memory efficiently. DARPA funded their research. Universities used their machines. The architecture was genuinely ahead of its time.⁵

But the market didn't follow. Revenue never met projections. By 1991, Encore needed a $50 million revolving loan and $80 million in refinanced debt from Japan Energy Corporation just to stay alive.⁴ The storage division was sold to Sun Microsystems in 1997. The real-time computing group was sold to Gores Technology Group in 1998. By 1999, Encore Computer Corporation effectively ceased to exist.⁵

ERPC went with it. No one runs it. No one implements it. Port 121 sits in the registry, assigned to a protocol that has no living users.

Port 121 in Practice

Because ERPC sees no legitimate traffic, port 121 has a different kind of history: malware. In the early 2000s, at least three trojans were documented using port 121 for command and control communication.⁶

• Attack Bot: A remote access trojan
• God Message: An ActiveX-based trojan targeting Windows 95/98/ME/NT/2000 systems running Internet Explorer 5
• JammerKillah: An anti-protection trojan and dropper for Windows 95/98/ME

This is a common fate for abandoned well-known ports. When a port has no legitimate service listening on it, any traffic on that port is suspicious by definition, which makes it both a useful signal for intrusion detection and a tempting target for malware authors who know the port won't be monitored by legitimate services.

How to Check What's Listening on Port 121

If you see traffic on port 121, investigate immediately. There is no modern legitimate service that uses this port.

Linux:

sudo ss -tlnp | grep :121
sudo lsof -i :121

macOS:

sudo lsof -i :121

Windows:

netstat -ano | findstr :121

Any process bound to port 121 warrants scrutiny. If you didn't put it there, something else did.

Where Port 121 Sits

Port 121 is a well-known port, meaning it falls in the range 0 through 1023, the ports reserved by IANA for system-level services.⁷ On most Unix-like systems, binding to a well-known port requires root privileges.

Its neighbors tell you something about the era when these assignments were made:

Port 121 sits between Usenet and the protocol that synchronizes every clock on the Internet. Its neighbors thrived. It didn't.

Why Ghost Ports Matter

The IANA registry has hundreds of ports like 121: assigned decades ago to protocols that no longer exist, for companies that no longer operate, solving problems on hardware that no longer runs. They can't easily be reassigned because the registration process for well-known ports requires IETF standardization, and no one is going to write an RFC to reclaim a port number.⁷

These ghost ports serve as the Internet's archaeological record. Port 121 tells you that in 1984, a company called Hydra thought inter-process communication could be faster, and a company called Encore thought parallel computing was the future. They were right about both things. They just didn't survive long enough to see the world catch up.

A sample Encore Multimax system, donated by the Naval Postgraduate School, sits in storage at the Computer History Museum.⁵ Port 121 sits in the IANA registry. Both are artifacts of the same ambition.