Port 201 is officially assigned to at-rtmp (AppleTalk Routing Maintenance Protocol), a protocol that once kept Mac-based networks synchronized. Both TCP and UDP use this port, though you'll almost never see it in use today.
What at-rtmp Did
AppleTalk was Apple's networking protocol suite from the 1980s and 1990s. Before TCP/IP dominated, Mac networks spoke their own language. Port 201 was the designated port for the Routing Table Maintenance Protocol (RTMP)—the mechanism that kept AppleTalk routers informed about network topology.1
Here's how it worked: Every 10 seconds, each router broadcast its routing table to neighboring routers. These packets contained network numbers, hop counts, and path information. When a router received these broadcasts, it updated its own routing table, recalculating the best paths to reach each network.2
It was simple, periodic, and noisy. Every 10 seconds. Whether anything changed or not.
The Historical Context
In April 1988, the Network Information Center (NIC) assigned a range of UDP ports starting at 200 for AppleTalk well-known sockets. Port 201 became at-rtmp (AppleTalk Routing Maintenance), alongside port 202 for name binding, port 203 for echo, and port 204 for zone information.3
This was the era when Apple controlled its own networking stack. AppleTalk enabled file sharing, printing, and service discovery across Mac networks without requiring complex configuration. It just worked—at least for Macs.
But AppleTalk had fundamental limitations. The routing protocol was chatty (broadcasts every 10 seconds), the addressing scheme was limited (16-bit network numbers), and it didn't scale well beyond departmental networks. As the Internet grew and TCP/IP became universal, AppleTalk became a relic.
Apple officially deprecated AppleTalk in Mac OS X 10.6 (Snow Leopard) in 2009. The protocol that justified port 201's existence was declared dead.4
Why This Port Still Exists
Port 201 remains officially assigned by IANA. The assignment hasn't been reclaimed or reassigned. It sits in the well-known ports range (0-1023), reserved for a protocol that no longer runs.
This is the strange archaeology of the Internet's port system. Ports don't get "deleted" when their protocols die. They remain assigned, marked in registries, occupying space in the namespace. Port 201 is a tombstone—it marks where something used to be.
Security Note
Some historical reports flagged port 201 as potentially used by malware or trojans.5 This is common for obscure, unused ports. Malware authors sometimes repurpose forgotten ports precisely because they're unlikely to be monitored or filtered. If you see traffic on port 201 today, it's almost certainly not legitimate AppleTalk routing—it's worth investigating.
How to Check What's Using Port 201
On Linux or macOS:
On Windows:
If you see something listening here, it's either legacy AppleTalk software (extremely unlikely) or something else that's claimed this abandoned port.
The Bigger Picture
Port 201 represents a specific moment in networking history: when proprietary network protocols competed with open standards, when Mac networks spoke differently than PC networks, when the Internet wasn't yet inevitable.
AppleTalk lost. TCP/IP won. And port 201 became a historical marker—a reminder that the port system preserves everything, even the protocols that disappeared.
Related Ports
- Port 202: at-nbp (AppleTalk Name Binding Protocol)
- Port 203: at-echo (AppleTalk Echo Protocol)
- Port 204: at-zis (AppleTalk Zone Information Protocol)
The entire AppleTalk port range (200-204) tells the same story: officially assigned, functionally extinct.
Frequently Asked Questions
Was this page helpful?