Port 311: AppleShare IP WebAdmin — The Forgotten Apple Server Door

Port 311 is officially assigned by IANA to asip-webadmin (AppleShare IP WebAdmin), a web-based administration interface for Apple's server software from the late 1990s and early 2000s.¹ This is a System Port in the well-known range (0-1023), meaning it was reserved for a specific service by the Internet Assigned Numbers Authority.

What It Was

AppleShare IP WebAdmin provided a web interface for managing Mac OS X Server. An administrator could open a browser, connect to port 311 on the server, enter credentials, and configure file sharing, web services, mail servers, user accounts, and other server functions.²³

This was part of AppleShare IP, Apple's evolution of their AppleShare file server software to support TCP/IP networks instead of just AppleTalk.⁴ The web administration interface was a modern convenience for its time—managing servers through a browser rather than requiring proprietary client software.

Why It Mattered

In the late 1990s, making server administration accessible through a web browser was forward-thinking. Port 311 meant you could manage your Mac server from any computer with a browser and network access. No special client software required. Just a URL, a port number, and a password.

Current Status

Port 311 is deprecated. Apple discontinued the AppleShare product line years ago, transitioning to macOS Server with different management tools and protocols.⁵ Modern Apple server management doesn't use port 311.

Legacy environments might still have this port exposed, but that's a security concern. The administration traffic on port 311 was generally unencrypted unless tunneled through a VPN or wrapped in SSL.⁶ Sending administrative credentials and commands in plaintext over a network is exactly what modern security practices warn against.

Security Considerations

If you find port 311 open on a modern network, it's worth investigating:

• Is there an old Mac server still running AppleShare IP? (Unlikely but possible in legacy environments)
• Has malware opened this port? (Some older trojans used port 311 for communication)⁷
• Is this a misconfiguration or forgotten service?

Check what's listening on port 311:

# On macOS/Linux
sudo lsof -i :311
sudo netstat -an | grep 311

# On Windows
netstat -ano | findstr :311

The Honest Truth

Port 311 is a ghost. It represents Apple's brief era of trying to compete in the server market—a market they eventually abandoned entirely. The Xserve hardware is gone. macOS Server is barely maintained. Port 311 sits in the IANA registry as a marker of a product line that no longer exists.

Most ports in the well-known range carry protocols that outlived their creators. Port 311 didn't. It was tied too closely to a specific product from a specific company, and when that product died, the port became a historical footnote.

If you encounter port 311 today, you're probably looking at either a very old system someone forgot to decommission or something pretending to be an old Apple service. Neither is good.

Related Ports

• Port 548 - AFP (Apple Filing Protocol), used for actual file sharing on AppleShare servers
• Port 427 - SLP (Service Location Protocol), used for discovering AppleShare servers on the network
• Port 80/443 - HTTP/HTTPS, which modern web-based server administration interfaces use instead