Port 47: The Ghost of NI FTP — A Number with Two Lives

Port 47 is a well-known port with no well-known service. It sits in the reserved range (0 to 1023), the ports that IANA controls with the tightest grip, the ones that historically required an IETF Review or IESG Approval to claim.¹ And yet, as of May 18, 2017, IANA removed port 47's assignment entirely.² The door is closed. The room behind it is empty.

But it wasn't always.

The Protocol That Was: NI FTP

Port 47 was registered to NI FTP, which stood for Network Independent File Transfer Protocol. The contact listed in the IANA registry was Steve Kille, an English software engineer who has been working on Internet technologies since 1980.³

Kille is not a minor figure. He authored over 40 IETF RFCs. He was one of the principal engineers behind ISODE, the open-source implementation of the OSI protocol stack. He co-created LDAP. From 1981 to 1992, he was a Senior Research Fellow at University College London, the same institution that established the UK's first ARPANET connection.⁴ He also registered port 61 for NI MAIL, a companion mail protocol.

NI FTP was part of the Coloured Book protocols, a set of communication standards developed in the United Kingdom in the 1970s.⁵ Each protocol was identified by the color of its specification document's cover. NI FTP was defined in the Blue Book. It was designed to be network-independent, meaning it could operate over multiple underlying transport services, not just TCP/IP. The UK academic community used it on SERCnet starting in 1980, on SWUCN from 1982, and on the JANET academic network when those networks merged in 1984.

This is important context: in the late 1970s and 1980s, the UK was building its own protocol stack alongside, and sometimes in competition with, the ARPANET/Internet protocols coming out of the United States. The Coloured Book protocols gave the UK "several years lead over other countries" in academic networking.⁵ NI FTP was part of that independent vision.

The vision didn't last. By the early 1990s, the Internet protocol suite won. From late 1991, Internet protocols were adopted on JANET. The Coloured Book protocols were phased out. X.25 support ended entirely in August 1997.⁵

And on May 18, 2017, IANA removed NI FTP's registration on port 47. No announcement. No ceremony. Just a status change in a database.

The Number's Second Life: IP Protocol 47

Here is where port 47 becomes genuinely interesting, and genuinely confusing.

GRE (Generic Routing Encapsulation) is one of the most important tunneling protocols on the Internet. Developed by Cisco and standardized in RFC 1701 and RFC 2784, GRE creates virtual point-to-point links that can encapsulate almost any network layer protocol inside IP tunnels.⁶ It is foundational to VPN infrastructure. PPTP, one of the earliest widely deployed VPN protocols, uses GRE for its data channel.

GRE is identified as IP Protocol number 47.⁶

This is not the same thing as TCP/UDP port 47. Not even close. IP protocol numbers and port numbers are different namespaces operating at different layers. TCP is IP Protocol 6. UDP is IP Protocol 17. GRE is IP Protocol 47. These numbers appear in the IP header's protocol field, one layer below where port numbers live.

But people confuse them constantly. Search for "port 47" and you will find pages that discuss GRE tunneling, PPTP VPNs, and firewall rules for "opening port 47." The confusion is so pervasive that multiple networking reference sites include explicit disclaimers: "GRE is IP Protocol 47, not port 47."⁷

The result is that the number 47 is famous in networking, but for the wrong reasons when applied to ports. The port is empty. The protocol number is essential.

What Range Is This?

Port 47 falls in the well-known port range (0 to 1023). These ports are controlled by IANA and traditionally require elevated privileges to bind to on Unix-like systems. They were designed for foundational Internet services: HTTP on 80, SSH on 22, DNS on 53.¹

A well-known port without an assignment is unusual. Most ports in this range carry something. Port 47 carried something once, lost it, and now sits reserved, waiting for a future that may never come.

How to Check What's Listening on Port 47

On most systems, nothing will be listening on port 47. But you can verify:

Linux:

sudo ss -tlnp | grep :47
sudo netstat -tlnp | grep :47

macOS:

sudo lsof -i :47

Windows:

netstat -an | findstr :47

If something is listening on port 47, investigate immediately. No standard service uses this port. Traffic on port 47 could indicate misconfigured software or unauthorized activity.

Why Unassigned Ports Matter

Every unassigned port is a sentinel. When you see traffic on a port that should be silent, that traffic demands explanation. Unassigned ports serve as canaries in network security: if something is talking on a port where nothing should be talking, something is wrong.

IANA's policy states that deassigned port numbers should not be reassigned until all unassigned ports in the range have been used.¹ Port 47 isn't just empty. It's intentionally preserved. The absence of a service is itself a form of information.