Port 97: Swift-RVF — The Protocol That Left Only Its Name

What Port 97 Does

Port 97 is assigned to the Swift Remote Virtual File Protocol, known by its IANA service name swift-rvf. It is registered for both TCP and UDP.¹

That is nearly everything anyone can tell you about it.

No RFC describes the protocol. No software ships with it. No documentation explains what "Swift Remote Virtual File" meant to the person who registered it. The protocol exists as a name in a registry and nothing more.

The Registration

The assignment appears in RFC 1700, the last great snapshot of the Internet's assigned numbers, published in October 1994 by Joyce Reynolds and Jon Postel.² In that document, port 97 is listed as:

swift-rvf    97/tcp    Swift Remote Virtural File Protocol
swift-rvf    97/udp    Swift Remote Virtural File Protocol

The contact is listed as Maurice R. Turcotte, reachable at a UUCP-style email address: mailrus!uflorida!rm1!dnmrt%rmatl@uunet.UU.NET.²

That email address is a fossil. UUCP (Unix-to-Unix Copy Program) routing used exclamation marks to chain machines together in an era before DNS made email addressing simple. The address tells you this registration came from somewhere in the University of Florida ecosystem, routed through UUNET, one of the earliest commercial Internet service providers.

The Typo That Nobody Fixed

The IANA registry spells it "Virtural" instead of "Virtual." This misspelling has been faithfully preserved in the official registry for over thirty years.¹ Nobody has submitted a correction, because nobody has had reason to look at this entry. The typo is, in its own way, a perfect monument to the protocol's obscurity.

What We Can Infer

The name "Swift Remote Virtual File Protocol" suggests a remote file access system. In the late 1980s and early 1990s, when this port was likely assigned, networked file access was a frontier. NFS (Network File System) was gaining traction. FTP was ubiquitous but clunky for programmatic use. Various groups were building alternatives.

"Virtual File" implies an abstraction layer, presenting remote files as if they were local. "Swift" may have been a project name or an aspiration. Whatever it was, it did not survive contact with the market. NFS won the Unix world. SMB/CIFS won the Windows world. Swift-RVF left only its port number.

The Range

Port 97 sits in the well-known ports range (0 through 1023), also called system ports. These are assigned by IANA through IETF Review or IESG Approval.³ On Unix-like systems, binding to a port in this range requires superuser privileges.

Being in the well-known range was once a mark of importance. It meant the IETF community considered your protocol significant enough to deserve a reserved number below 1024. Port 97 received that honor. It just never did anything with it.

Security

Port 97 has been historically flagged by some security scanners because malware has occasionally used it for communication.⁴ This is not unique to port 97. Any quiet, rarely monitored port is attractive to malware authors precisely because it is quiet and rarely monitored. An unassigned or forgotten port draws less attention than port 80 or port 443.

If you see traffic on port 97 on your network, investigate. Nothing legitimate should be using it.

How to Check What Is Listening on Port 97

Linux:

sudo ss -tlnp | grep :97
sudo netstat -tlnp | grep :97

macOS:

sudo lsof -i :97

Windows:

netstat -an | findstr :97

If anything is listening on port 97, you almost certainly did not put it there.

Why Forgotten Ports Matter

The Internet has 65,535 ports. Thousands of them, like port 97, are assigned to protocols that never gained traction, or that served a purpose for a brief window and then vanished. These ports are not useless. They are informative.

They tell us that the Internet was not inevitable. The protocols we use today, HTTP, SSH, DNS, SMTP, won through a process of competition and accident. For every protocol that became infrastructure, dozens were registered, tried, and forgotten. Port 97 is one of the forgotten ones. Its existence reminds us that the Internet we have is not the only Internet that could have been.

Somewhere, Maurice R. Turcotte built something he called Swift Remote Virtual File Protocol. He thought it mattered enough to register a well-known port for it. He was not wrong to try. The Internet was built by people who tried.