Port 147: ISO-IP — The Protocol War's Testing Ground

Port 147 is assigned to ISO-IP, a protocol for tunneling ISO Open Systems Interconnection network layer traffic over the Internet. It was part of an experiment called EON, the Experimental OSI Network, where engineers used the very Internet they were trying to replace as a testbed for its government-mandated successor.¹

The successor lost. Port 147 is still here.

What ISO-IP Does

ISO-IP encapsulates OSI Connectionless Network Protocol (CLNP) packets inside UDP datagrams. When a system sends an ISO network layer packet to port 147, the receiving system strips the UDP wrapper and processes it as if it arrived over a native OSI network.¹

The protocol supports four types of network layer traffic:

• ISO 8473 (CLNP): The connectionless network protocol, OSI's answer to IP
• ISO 9542 (ES-IS): End System to Intermediate System routing
• IS-IS: Intermediate System to Intermediate System routing
• Unicast, multicast, and broadcast simulated through a SubNetwork Access Protocol layer

Port 147 specifically serves the UDP variant of EON. The IP-native variant uses IP protocol number 80 directly, bypassing UDP entirely. The two variants do not interoperate. Port 147 exists for implementors who cannot access the raw IP layer in their systems.¹

The Protocol Wars

To understand why port 147 exists, you need to understand that in the 1980s, there were two competing visions for global networking.

On one side: TCP/IP. Born from ARPANET, maintained by volunteers, built on working code and rough consensus. On the other: the OSI protocol suite. Designed by committee at the International Organization for Standardization, backed by European telecom monopolies, endorsed by governments worldwide.²

In 1988, the US Department of Commerce mandated compliance with the OSI model through the Government Open Systems Interconnection Profile (GOSIP). The US Department of Defense planned to transition away from TCP/IP. European governments restricted funding for non-OSI protocols. On paper, OSI was going to win.²

There was one problem. OSI existed mostly on paper. TCP/IP existed as running code on a growing network of interconnected machines.

RFC 1070 and the Birth of EON

In February 1989, Robert Hagens and Nancy Hall at the University of Wisconsin-Madison, together with Marshall Rose at The Wollongong Group, published RFC 1070: "Use of the Internet as a Subnetwork for Experimentation with the OSI Network Layer."¹

The idea was audacious: use the Internet itself as infrastructure to test OSI protocols. Wrap OSI packets inside IP datagrams. Build a virtual OSI network on top of the TCP/IP network it was supposed to replace.

The RFC is explicit about its limitations: "The methods proposed in this RFC are suitable ONLY for experimental use on a limited scale. These methods are not suitable for use in an operational environment."¹

EON treated the entire Internet as a single subnetwork. Participating systems registered with IANA, which maintained two configuration files: core.EON for routers and hosts.EON for end systems. Any system could change its role, from end system to router and back, at any time, allowing engineers to test the dynamic routing properties of OSI protocols without building a separate physical network.¹

Marshall Rose

The name on port 147's IANA registration is Marshall Rose, one of the most prolific contributors in Internet history.³

Rose earned his PhD from UC Irvine in 1984 and went on to author more than 60 RFCs. He is the principal designer of SNMP, the protocol that made network management possible at scale. He standardized POP3, the protocol that let millions of people download their email. He chaired multiple IETF working groups and served as Area Director for network management.³

But his work that led to port 147 came from an earlier chapter. In the mid-1980s, Rose developed ISODE, the ISO Development Environment, a public-domain implementation that let OSI applications run over TCP/IP. He co-authored RFC 1006 with Dwight Cass, defining how to carry ISO transport services over TCP on port 102.⁴ He then contributed to RFC 1070, extending this bridge down to the network layer with EON on port 147.

Rose was building bridges between two worlds. He understood that for OSI to have any chance, it needed running code, not just committee documents. The Internet was the fastest way to get that code running.

The Sibling Ports

Port 147 lives next to its sibling, port 146 (ISO-TP0), which serves a related but distinct purpose.⁵

Port 102 carries ISO transport. Port 146 bridges ISO transport to X.25 networks. Port 147 goes a layer deeper, carrying the entire ISO network layer. Together, they represent a complete strategy for running the OSI stack over TCP/IP infrastructure.

What Happened

OSI lost the Protocol Wars. Not because it was technically wrong, but because it was slow. The seven-layer model tried to specify everything in advance. TCP/IP shipped working code and fixed problems as they appeared.²

By the mid-1990s, the rapid growth of the commercial Internet made the outcome irreversible. GOSIP mandates were quietly dropped. European funding restrictions for non-OSI protocols dissolved. The OSI protocol suite faded into irrelevance, though the OSI reference model lives on as a teaching tool.²

Port 147 went silent.

Of the entire OSI protocol family, only three pieces survived in widespread use: X.500 evolved into LDAP for directory services, IS-IS remains a major routing protocol used by large ISPs, and X.400's concepts influenced modern email systems.²

Security Considerations

Port 147 has no meaningful security exposure in modern networks. The ISO-IP protocol it carries is not implemented in any current production system. No known malware targets this port specifically.

If you see traffic on port 147, it is almost certainly not ISO-IP. It is more likely an application that chose this port number arbitrarily, or scanning activity probing well-known port ranges.

How to Check What Is Listening on Port 147

Linux:

sudo ss -tlnp | grep :147
sudo lsof -i :147

macOS:

sudo lsof -i :147
netstat -an | grep '\.147 '

Windows:

netstat -an | findstr :147

Why This Port Matters

Port 147 is a fossil record of a turning point in computing history. It represents the moment when the Internet community acknowledged that the OSI protocols were coming, took them seriously enough to build testing infrastructure, and then watched as the market chose differently.

Marshall Rose understood something profound: you cannot evaluate a protocol suite without running it. So he and his collaborators built EON, wrapped OSI inside TCP/IP, and gave the world a way to experiment. That the experiment confirmed TCP/IP's dominance rather than enabling its replacement is one of technology's great ironies.

Every unassigned-feeling port in the well-known range tells a version of this story. These port numbers are not wasted space. They are the markers of paths the Internet explored and chose not to take. Port 147 is a path the Internet explored at the explicit request of governments worldwide, using the Internet's own infrastructure to test its proposed replacement.

The replacement never came. The port remains assigned. The Internet kept being the Internet.