Port 167: NAMP — The Protocol That Stayed Silent

Port 167 is assigned to NAMP on both TCP and UDP.¹ The protocol never achieved meaningful adoption, and today, port 167 sits functionally silent on virtually every machine connected to the Internet.

But the name on the registration tells a story worth knowing.

What Is NAMP?

NAMP appears in the IANA Service Name and Transport Protocol Port Number Registry as the official assignment for port 167.¹ The exact expansion of the acronym is unclear. Various sources refer to it as "Network Administration Message Protocol" or associate it loosely with NIS+ authentication services, but no RFC defines NAMP, and no widely adopted implementation exists.²

What we know for certain: NAMP was registered by Marty Schoffstall.¹

That name matters.

The Person Behind the Port

Martin Lee Schoffstall, Rensselaer Polytechnic Institute class of 1982, was one of the four co-authors of the Simple Network Management Protocol (SNMP).³ Along with Jeffrey Case, Mark Fedor, and James Davin, Schoffstall wrote RFC 1067, RFC 1098, and RFC 1157, the documents that defined how the Internet would monitor and manage its own infrastructure.⁴

Before SNMP, Schoffstall co-authored the Simple Gateway Monitoring Protocol (SGMP), published as RFC 1028 in 1987.⁵ SGMP was the prototype. SNMP was the product. By 1990, fifty companies demonstrated SNMP solutions at Interop, and the protocol became the backbone of network management worldwide.

Schoffstall then co-founded PSINet in 1989, one of the first commercial Internet service providers.⁶ He and William Schrader funded the company partly through personal loans and by selling the family car. PSINet went on to co-found the Commercial Internet eXchange (CIX) in 1991, helping create the commercial Internet as we know it.

This is the person who registered port 167.

A Port in the Shadow of Giants

Look at the neighborhood. Port 161 is SNMP. Port 162 is SNMP Trap. These are two of the most widely deployed protocols in the history of networking, running on nearly every managed device on Earth. Port 153 is SGMP, their predecessor.

Port 167 sits just a few doors down, registered by one of the same people. It never caught on. No RFC. No widespread implementation. No fifty vendors at a trade show.

The late 1980s were a period of rapid experimentation in network management. The Internet Engineering Task Force was spinning up working groups, allocating port numbers, and racing to solve the problem of managing a growing network of networks. Many protocols were proposed. A few survived. SNMP won decisively. NAMP did not.

The Well-Known Range

Port 167 falls within the well-known port range (0-1023), which is controlled by IANA and historically required system-level privileges to bind.⁷ Assignments in this range follow "IETF Review" or "IESG Approval" procedures as defined in RFC 6335.⁸

Being in this range means port 167 was considered significant enough to reserve at the system level. The Internet's early architects expected NAMP to matter. The protocol simply never grew into that expectation.

Security Considerations

Port 167 has no significant history of exploitation. Some security databases flag it based on automated scanning heuristics, but there are no well-documented trojans or vulnerabilities specific to this port.²

Because NAMP sees no legitimate traffic on modern networks, any activity on port 167 should be treated with suspicion. An open port with no expected service is a signal worth investigating.

Checking Port 167 on Your System

Linux/macOS:

# Check if anything is listening on port 167
sudo lsof -i :167

# Scan port 167 on a remote host
nmap -p 167 <target-ip>

Windows:

# Check local listeners
netstat -an | findstr ":167"

If something is listening on port 167 and you did not put it there, find out what it is.

Why Unassigned Ports Matter

Port 167 is not technically unassigned. It has a name. It has an owner. It simply has no living protocol behind it.

The Internet has 65,535 ports. Of these, IANA has assigned services to roughly 1,200 in the well-known range alone. Many of those assignments, like NAMP, refer to protocols that were proposed but never widely deployed. They are reservations that were never checked into.

These silent ports serve as reminders that the Internet was not inevitable. It was built through thousands of experiments, most of which failed. Every port that carries traffic today stands on the shoulders of ports that never did.