Port 213: IPX — The Ghost of Novell's Empire

Port 213 is a ghost port. It carries IPX (Internetwork Packet Exchange) traffic tunneled through UDP—a protocol from when Novell NetWare ran 70% of corporate networks and TCP/IP wasn't yet inevitable. Today it's a monument to a lost empire, still assigned by IANA but rarely seen in the wild.

What IPX Was

In the late 1980s and through the 1990s, Novell NetWare was everywhere. Banks, schools, corporations—if you had a network, you probably ran NetWare. And NetWare spoke IPX.¹

IPX was Novell's adaptation of Xerox's Internet Datagram Protocol. It was connectionless, had a tiny memory footprint (crucial for DOS and early Windows), and configured itself automatically.² In an era when TCP/IP required manual IP address assignment and subnet calculations, IPX just worked.

But as the Internet exploded in the mid-1990s, TCP/IP became unavoidable. Organizations needed to connect their IPX networks to IP networks. They needed a bridge.

The Bridge Protocol

In June 1991, Don Provan from Novell wrote RFC 1234: "Tunneling IPX traffic through IP networks."³ The idea was simple: wrap IPX datagrams inside UDP packets. Pick a port number. Send them across IP networks. Unwrap them on the other side.

IANA assigned port 213 for this encapsulation technique.⁴

The RFC is remarkably pragmatic. IPX implementations never used checksums (the IPX checksum field was always ignored), so Provan strongly recommended UDP checksumming instead. The address mapping was clever: embed the four-octet IP address in the last four octets of the IPX host number, with the first two octets zeroed out.³

It worked. Organizations could keep their NetWare networks while slowly migrating to TCP/IP infrastructure.

The Decline

NetWare version 5, released in late 1998, added full TCP/IP support.⁵ You could finally run Novell without IPX. By then, TCP/IP had won. The Internet was too big, too universal, too inevitable.

Windows XP was the last Windows version to support IPX/SPX.⁵ Linux removed SPX support in 2002 and IPX support entirely in 2018.⁵ The protocol that once powered the majority of corporate networks became a curiosity, then a liability, then nothing.

What Remains

Port 213 remains officially assigned to IPX in IANA's registry.⁶ If you scan for it today, you'll find almost nothing. Maybe a forgotten NetWare server in a basement somewhere, still tunneling IPX through UDP, still speaking the language of a vanished empire.

The port exists as a reminder: every dominant technology eventually becomes legacy. Every empire falls. What seems inevitable today will be a curiosity tomorrow.

Why This Port Matters

Port 213 is a lesson in network archaeology. It shows that the Internet's current architecture—TCP/IP everywhere, all the time—wasn't preordained. There were alternatives. IPX was simpler, easier to configure, lighter on resources. It lost anyway, because the Internet's network effect was too powerful.

The port also demonstrates something beautiful about Internet infrastructure: bridges matter. Port 213 didn't save IPX, but it bought time. It let organizations migrate gradually instead of ripping out their entire network infrastructure overnight. It was a kind protocol, a gentle protocol, designed to ease a painful transition.

Checking for IPX Traffic

To see what's listening on port 213:

Linux/Mac:

sudo lsof -i :213
sudo netstat -tulpn | grep :213

Windows:

netstat -ano | findstr :213

You probably won't find anything. But if you do, you've found something genuinely rare: a living fossil, still speaking the language of Novell's golden age.

Related Ports

• Port 137-139: NetBIOS, another legacy protocol suite from the PC networking wars
• Port 520: RIP (Routing Information Protocol), used by IPX/RIP for network routing