Port 77: Private RJE — The Custom Door to the Mainframe

What Port 77 Does

Port 77 is assigned by IANA for priv-rje, described as "any private RJE service."¹ It carries no traffic on the modern Internet. It is a well-known port (range 0-1023) with a formal assignment, a named contact (Jon Postel), and no one left who uses it.

RJE stands for Remote Job Entry, a protocol from the era when computing meant submitting a stack of punch cards to a mainframe and waiting for results. Port 77 was specifically reserved for private implementations of this protocol, as opposed to the standard RJE service on port 5.²

The RJE Family of Ports

Port 77 does not exist in isolation. It belongs to a small family of ports dedicated to remote batch job submission:

The word "private" is the key. Ports 71-74 handled UCLA's NETRJS protocol for their IBM 360 Model 91.³ Port 5 was the standard, public RJE. Port 77 was the escape hatch: if your organization had its own custom way of submitting batch jobs remotely, this was your port. No protocol specification required. Just a number and a handshake with Jon Postel.

The History

Remote Job Entry

Before interactive computing, before terminals, before screens, there was batch processing. You wrote your program on punch cards, handed them to an operator, and waited. Remote Job Entry made it possible to do this from a distance, submitting jobs to a mainframe over a network connection.⁴

The protocol was formalized through a series of RFCs. RFC 360 proposed the Remote Job Entry Protocol in June 1972. RFC 407, authored by Robert Bressler, Richard Guida, and Alex McKenzie, replaced it in October 1972.⁵ The protocol used the File Transfer Protocol to move job files and TELNET for command communication.

Jon Postel and the Port Registry

Port 77's assignment traces back to Jon Postel, the person who, more than anyone else, organized the early Internet's numbering systems. In March 1972, Vint Cerf and Postel called for establishing a catalog of socket numbers in RFC 322. By December 1972, Postel published RFC 433, the first registry, calling himself the "czar of socket numbers."⁶

He maintained the "Assigned Numbers" RFC series for decades: RFC 739 (1977), RFC 755 (1979), RFC 776 (1981), RFC 820 (1983), each one obsoleting the last, each one a snapshot of the Internet's growing nervous system.⁷ Port 77 appears in these early lists, assigned and waiting.

IBM and the Mainframe World

In practice, RJE lived inside IBM's mainframe ecosystem. The IBM 3770 data terminals, consisting of card readers, diskette drives, card punches, and line printers, connected to host systems through modems and digital links.⁸ Houston Automatic Spooling Priority (HASP) and its successor protocols handled the actual job scheduling.

RJE eventually evolved into Network Job Entry (NJE), which supported peer-to-peer job transfer between multiple data centers rather than the hub-and-spoke model of classical RJE. NJE added support for SNA, then TCP/IP, carrying batch computing forward into the networked age.⁸

Port 77, however, stayed behind. It was for private RJE, the custom implementations that organizations built for their own needs. When those organizations modernized, they did not look back.

Security

Port 77 has been flagged in security databases as having been used by trojans in the past.⁹ This is less about port 77 being inherently dangerous and more about what happens to abandoned ports: they become convenient hiding places.

On a modern network, there is no legitimate reason for traffic on port 77. If you see it, investigate immediately. The last person who had a good reason to use this port was probably using a card reader.

How to Check What Is Listening on Port 77

# macOS / Linux
sudo lsof -i :77
netstat -an | grep ':77 '

# Windows
netstat -an | findstr ":77 "

# Nmap scan
nmap -p 77 target_host

If anything responds, you should be asking why. The answer is unlikely to be "private Remote Job Entry service."

Why Unassigned and Legacy Ports Matter

Port 77 is technically assigned, not unassigned, but it occupies the same practical space: a well-known port with no modern traffic. These ports matter for several reasons:

They are the archaeology of the Internet. Every assigned port in the well-known range (0-1023) tells you what someone, somewhere, needed badly enough to request a permanent number from Jon Postel. Port 77 tells you that private RJE implementations were common enough to warrant their own reserved door.

They are security indicators. Traffic on a port with no legitimate modern use is, by definition, suspicious. Network administrators who understand what should be on each port can spot what should not be.

They preserve the design philosophy. The well-known port range was always meant to be small and carefully managed. Only 1,024 numbers. Each one assigned through a process that, in the early days, meant convincing one person (Postel) that your protocol mattered. Port 77 earned its place. The fact that it is no longer needed does not erase the need that created it.