Port 127: Locus-Con — The Bridge Between DOS and UNIX

What Port 127 Does

Port 127 is registered with IANA as locus-con, the Locus PC-Interface Connection Server¹. It operates on both TCP and UDP. Its job was straightforward: let a PC running MS-DOS or Windows connect to a UNIX file system over a network and use it as if it were a local drive.

The connection server (port 127) worked alongside port 125, the locus-map service, which acted as a directory, maintaining a list of available shared disk areas and machines. Port 125 was the map. Port 127 was the door. A PC client would consult the map server to find what was available, then connect through port 127 to access an exported partition².

The Story Behind It

In the early 1980s, personal computers and UNIX workstations existed in separate worlds. PCs ran DOS. Serious computing happened on UNIX. If you needed files from a UNIX system on your PC, you were looking at manual transfers, sneakernet, or frustration.

Locus Computing Corporation was founded in 1982 by Gerald J. Popek, Charles S. Kline, and Gregory I. Thiel to commercialize technologies developed for the LOCUS distributed operating system at UCLA³. Their flagship product, PC-Interface, was a LAN-based cross-platform integration toolkit that made UNIX file systems transparently accessible to DOS, Windows, and Macintosh clients⁴.

The port registration was made by Eric Peterson (lcc.eric@SEAS.UCLA.EDU), tying port 127 directly to UCLA's School of Engineering and Applied Science where Locus had its roots¹.

IBM recognized the value and bundled the server-side components with AIX under the name AIX Access for DOS Users (AADU)². When Windows 95 support arrived, the product was renamed PC-Enterprise. Then in 1995, Platinum Technology acquired Locus Computing for approximately $33 million, and the product became PLATINUM PC-Enterprise³.

The company is gone. The product is gone. Port 127 remains registered.

The Other 127

There is a coincidence worth noting. The number 127 is one of the most famous numbers in all of networking, but not because of this port. 127.0.0.1 is the IPv4 loopback address, the address a machine uses to talk to itself. The entire 127.0.0.0/8 block (127.0.0.1 through 127.255.255.255) is reserved for loopback⁵.

Port 127 and address 127 have nothing to do with each other. They are two separate namespaces that happen to share a number. But the coincidence means that "127" carries a double weight in networking: the machine talking to itself, and a forgotten bridge between two operating systems that couldn't talk to each other.

Security

Port 127 sits in the well-known range (0-1023), which means binding to it requires superuser privileges on UNIX-like systems⁶. No modern service legitimately uses this port. If you see traffic on port 127, investigate immediately. Like many disused well-known ports, it has appeared in trojan port lists as a potential vector for unauthorized remote access.

How to Check What Is Listening on Port 127

Linux:

sudo ss -tlnp | grep :127
sudo netstat -tlnp | grep :127

macOS:

sudo lsof -i :127

Windows:

netstat -an | findstr :127

If anything is listening on port 127 and you are not running legacy Locus PC-Interface software (you are not), something unexpected is happening on your machine.

Why Unassigned and Legacy Ports Matter

Port 127 is not unassigned. It is assigned to a service that no longer exists. This is a different kind of silence. IANA does not reclaim port assignments from defunct products. The registry is append-only in practice. Port 127 will carry the name "locus-con" for as long as the registry exists, a permanent reservation for software that stopped running decades ago.

This matters because the well-known port range (0-1023) contains only 1,024 slots. Every slot occupied by a ghost service is one fewer slot available for future protocols. The scarcity of well-known ports is real, and the ghosts take up space.