Port 522 sits in the well-known ports range (0-1023), officially assigned by IANA to the User Location Protocol (ULP). But if you're looking for active traffic on this port today, you won't find much. Port 522 is a technological fossil—a remnant from the earliest days of Internet collaboration software.
What ULP Was
ULP (User Location Protocol) was a directory service protocol designed to help users locate each other on networks. Think of it as a "who's online and where" service for early collaborative applications.
The protocol operated over both TCP and UDP on port 522, allowing clients to query a User Location Server (ULS) to find other users who were available for communication.1
The NetMeeting Connection
Port 522's primary claim to fame was its use in Microsoft NetMeeting 1.0, released in 1996. NetMeeting was Microsoft's answer to Internet-based audio and video conferencing, and it needed a way for users to find each other on corporate networks and the Internet.2
User Location Servers running on port 522 maintained directories of online users. When you launched NetMeeting 1.0 and connected to a ULS, you'd see a list of other users who were available for calls, complete with their email addresses and other contact information.
For a brief moment in 1996, port 522 was carrying the future of Internet collaboration.
The Swift Obsolescence
By 1997, Microsoft had already moved on. NetMeeting 2.0 deprecated ULS in favor of Internet Locator Service (ILS), which used the Lightweight Directory Access Protocol (LDAP) on port 389.2 LDAP was a more robust, standardized directory protocol that could do everything ULS did and more.
Port 522 went from cutting-edge to obsolete in less than a year.
What This Port Tells Us
Port 522 is a reminder that the well-known ports range isn't just a list of active services—it's also a graveyard of protocols that once mattered. The IANA assigns these ports, but they don't revoke them when protocols become obsolete. Port 522 remains officially assigned to ULP, even though almost no one has used it in over two decades.
Security Considerations
Historical sources noted that port 522 "provides valuable user info for user-level attacks" and recommended not allowing it across untrusted networks without encryption.3 This was a legitimate concern in the 1990s when ULS servers were actively sharing user presence and location information.
Today, the security risk is minimal because the protocol is essentially dead. But the warning remains relevant: directory services that expose user information are attractive targets, which is one reason LDAP with proper access controls won out over simpler protocols like ULP.
How to Check What's on Port 522
If you're curious whether anything is listening on port 522 on your system:
Linux/Mac:
Windows:
You'll almost certainly find nothing. Port 522 is quiet.
Related Ports
- Port 389 — LDAP, the protocol that replaced ULP for directory services
- Port 1720 — H.323, used by later versions of NetMeeting for call signaling
- Port 5060 — SIP, the modern standard for Internet telephony that succeeded NetMeeting-era protocols
Frequently Asked Questions
Was this page helpful?