Port 38: RAP — The Road Not Taken

What Port 38 Does

Port 38 is assigned to RAP, the Route Access Protocol. Both TCP and UDP. Registered with IANA, defined in RFC 1476¹, published June 1993.

RAP is a distance-vector routing protocol. It distributes routing information across networks at every scale: from a single office LAN to an international carrier backbone. Two routers connect on TCP port 38, exchange their complete routing tables, then send only updates as things change. When the connection drops, each side forgets everything the other told it.

UDP port 38 serves a different purpose: peer discovery. Hosts can listen on this port to find local gateways without any prior configuration.

In practice, you will almost never see traffic on port 38 today. RAP was an experimental protocol. It never became a standard. But the port remains assigned, and the story behind it is worth knowing.

How the Protocol Works

RAP keeps things deliberately simple. Two peers open a symmetric TCP connection between their port 38 endpoints. Only one connection ever exists between any pair of peers. The protocol defines five commands¹:

• No-operation: A heartbeat. Resets timers, announces "I'm still here."
• Poll: Tests whether the other side is alive.
• Error: Reports protocol violations, with human-readable text.
• Add Route: Offers a new routing path with associated metrics.
• Purge Route: Withdraws a previously offered route.

When a connection starts, both sides simultaneously dump their full routing tables to each other. After that initial exchange, they send only changes. No acknowledgment of individual commands. Full-duplex, both directions at once.

This is a protocol that trusts its TCP connection. If the connection breaks, both sides purge everything they learned from the other. Clean slate. No stale routes lingering in memory.

The Story Behind Port 38

Robert Ullmann was a programmer at Process Software Corporation in Framingham, Massachusetts². In the late 1980s and early 1990s, the Internet was at a crossroads. IPv4's address space was running out, and the networking community was debating what should come next.

Ullmann had a vision. He designed TP/IX, which he called IPv7³, an entirely new network layer for the Internet. RAP was its routing protocol. The two were published together in June 1993: RFC 1475 for TP/IX, RFC 1476 for RAP.

His design philosophy was distinctive. While other protocol designers were building hierarchies (interior gateway protocols for inside networks, exterior gateway protocols for between networks), Ullmann refused the distinction. He argued that real networks don't divide cleanly into hierarchical domains with identifiable borders. Real networks "have many links across organizational structure and over back fences."¹

He wanted one protocol that could handle everything: autoconfiguration on a home LAN, complex policy routing for international carriers, and everything in between.

And he had a principle that reads like a rebuke to most of modern software engineering: "Protocols should become simpler as they evolve."¹

RAP even included currency-aware cost metrics using ISO 4217 currency codes. You could express routing costs in actual money. The protocol could calculate the cheapest path across a network in yen, dollars, or marks. In 1993, Ullmann was thinking about the economic topology of the Internet, not just the physical one.

What Happened

The Internet chose IPv6 instead of IPv7.

Ullmann moved from Process Software to Lotus Development Corporation, where he co-authored RFC 1707 (CATNIP)⁴, another attempt to bridge the old Internet and the new. That didn't become a standard either.

He spent his later years in Nairobi, Kenya, contributing to Wikipedia and Wiktionary. He passed away in 2011 at the age of 50⁵.

RAP never saw wide deployment. Port 38 sits in the well-known range, officially assigned, carrying almost nothing. A port reserved for a future that never arrived.

Security

Port 38 has been historically flagged by some security tools for potential malicious use⁶. This doesn't mean port 38 is inherently dangerous. It means that because so few legitimate services use this port, any traffic on it warrants investigation.

If you see unexpected connections on port 38, treat it the same way you'd treat any anomalous traffic on an obscure port: investigate, don't ignore.

How to Check What's Listening

# Linux
sudo ss -tlnp | grep :38
sudo netstat -tlnp | grep :38

# macOS
sudo lsof -iTCP:38 -sTCP:LISTEN
sudo lsof -iUDP:38

# Windows
netstat -an | findstr :38

The Bigger Picture

Port 38 belongs to the well-known range (0 through 1023), ports assigned by IANA and requiring elevated privileges to bind on Unix-like systems. It sits in the neighborhood of other early Internet protocols: port 37 (Time Protocol), port 39 (RLP, Resource Location Protocol), port 42 (Host Name Server).

These low-numbered ports are the archaeological layer of the Internet. Some carry billions of connections per day. Others, like port 38, carry the memory of a design that was technically sound, philosophically interesting, and historically bypassed.

RAP got two things right that took the rest of the Internet years to learn: routing should model the actual mess of real networks, and protocols should get simpler over time. That neither lesson was fully absorbed doesn't make them wrong.