Port 517: Talk — The Original Unix Chat Port

Port 517 is where Unix users first learned to chat across machines in real time.

What Runs on Port 517

Port 517 UDP was assigned to the talk protocol, a text-based communication system introduced with 4.2BSD in 1983¹. The service created a split-screen interface where two users could type simultaneously—your text appeared in one window, theirs in another. Each keystroke was transmitted in real time, visible as it was typed.

The protocol works through a daemon that listens on port 517. When you want to talk to someone, your client contacts the talk daemon on their machine, which displays:

Message from TalkDaemon@their_machine...
talk: connection requested by your_name@your_machine

Once accepted, both terminals split into synchronized windows for simultaneous conversation².

The Protocol Migration

Old versions of talk used port 517. Newer versions use port 518¹. This migration happened because the original talk protocol had compatibility issues—the documentation itself called the protocol "braindead"². When improvements were made, they moved to port 518 for ntalk (new talk), leaving 517 behind.

This makes port 517 a fossil. It represents the first version of a protocol that worked but needed immediate replacement.

The Honest Strangeness

The talk protocol was crude. The wire protocol was inefficient. The daemon design had known flaws. Yet it shipped with 4.2BSD anyway because Unix needed real-time communication between users on networked machines, and talk delivered that.

Engineers called their own protocol braindead and shipped it. Then they fixed it and moved on. Port 517 is evidence of this pragmatism—good enough to solve the problem, honest enough to acknowledge the flaws.

Legacy and Modern Status

Talk is largely obsolete. IRC appeared in 1988. Instant messaging evolved. Modern chat systems have encryption, presence indicators, message history, and multimedia support. Talk had none of this.

Yet talk is still included with most Unix-like systems today, including Linux, BSD distributions, and macOS¹. The command exists. The daemons can still run. Port 517 can still carry split-screen conversations if anyone wants them.

In practice, almost nobody does. Port 517 sits quiet in the well-known port range, a designated space for a protocol that solved a problem three decades ago.

Security Considerations

The talk protocol sends everything in plaintext. No encryption. No authentication beyond username verification. Anyone who can see the network traffic can read the conversation.

If you find port 517 open on a modern system during a security scan³, it usually means:

1. Legacy Unix services are still running
2. The system hasn't been hardened
3. Nobody has audited which daemons are listening

Port 517 isn't commonly exploited because it's rarely used. But an open talk daemon is a signal—this system might be running other outdated services too.

How to Check What's Listening

On Linux/Unix/macOS:

# See if anything is listening on port 517
sudo lsof -i :517
# Or using netstat
sudo netstat -tulpn | grep :517

On Windows:

netstat -ano | findstr :517

Most modern systems will show nothing. Port 517 typically sits silent.

Why This Port Matters

Port 517 represents the beginning of real-time networked communication on Unix. Before talk, users could send mail or write to each other's terminals locally. Talk made conversations work across machines.

The protocol was flawed from the start. The implementation was called braindead by its own maintainers. But it worked well enough that people used it, and it worked long enough for better solutions to emerge.

This is how the Internet was built—imperfect protocols that solved immediate problems, followed by better protocols that learned from the mistakes. Port 517 is the first draft. Port 518 is the revision. Modern chat systems are the descendants.

The port sits mostly unused now, a reserved address for a protocol that taught the Internet how to have conversations in real time.

Related Ports

• Port 518 — ntalk (new talk), the improved version that replaced the original talk protocol
• Port 194 — IRC (Internet Relay Chat), which largely superseded talk-based communication
• Port 5222 — XMPP, a modern instant messaging protocol