Port 99 is assigned to the Metagram Relay protocol. If you've never heard of it, you're not alone. By 2003, members of the Internet Engineering Steering Group were emailing each other trying to figure out what this protocol even was1.
What Is the Metagram Relay?
The Metagram Relay protocol was allocated port 99 for both TCP and UDP in the early 1980s. It appears in RFC 900 (June 1984)2 and RFC 923 (October 1984)3, listed simply as "Metagram Relay" with the contact tag [GEOF], referring to Geoff Goodfellow at SRI International.
The protocol was related to Goodfellow's pioneering work on relaying electronic messages to mobile devices. In 1982, Goodfellow posted a message to the ARPANET's Telecom Digest mailing list titled "Electronic Mail for People on the Move," describing his idea of forwarding email from ARPANET to alphanumeric pagers4. The Metagram Relay appears to have been part of this early infrastructure for bridging networks and mobile endpoints.
No formal specification or RFC dedicated to the Metagram Relay protocol has survived. The assignment exists. The documentation does not.
The Port That Outlived Its Protocol
Port 99 sits in the well-known range (0-1023), reserved for services assigned by IANA. These are the most privileged ports on any system, requiring root or administrator access on most operating systems. Getting a well-known port assignment in the early 1980s meant your protocol was considered important enough to be part of the Internet's permanent infrastructure.
The Metagram Relay got that designation. Then it disappeared from use while the assignment remained, frozen in the IANA registry like an insect in amber.
In October 2003, Margaret Wasserman of Nokia wrote to the IESG mailing list asking how to track down information about the "Metagram Relay Protocol" assigned to port 991. The trail led back to Goodfellow, who was still reachable online. But the protocol itself had long since fallen out of any observable use.
Geoff Goodfellow and Mobile Messaging
Goodfellow's work matters even if this specific protocol doesn't survive. He was one of the earliest people to see that electronic mail shouldn't be tethered to a desk. In the early 1990s, he founded RadioMail to commercialize wireless email. In 1992, RadioMail partnered with Research in Motion (RIM)4, the company that would later create the BlackBerry.
Port 99's Metagram Relay was a small piece of that larger vision: getting messages from wired networks to people in motion. The vision succeeded. This particular implementation did not.
Security: What You'll Actually Find on Port 99
Because the Metagram Relay protocol has no active implementations, any traffic you observe on port 99 today is almost certainly not legitimate Metagram Relay activity. Several trojans have historically used this port:
- NCX99 (also known as Backdoor.Win32.Ncx.b), a remote access trojan created in 2000, operates on TCP port 995
- Hidden Port, a backdoor trojan
- Mandragore, a trojan with remote control capabilities
If port 99 is open on a system and no one can explain why, investigate.
How to Check What's Listening on Port 99
Linux/macOS:
Windows:
If something is listening and it's not a service you recognize, treat it as suspicious.
The Well-Known Range
Port 99 belongs to the well-known port range (0-1023). These 1,024 ports are the original namespace of the Internet's service architecture, allocated by IANA since the earliest days of the ARPANET. On Unix-like systems, binding to a well-known port requires superuser privileges, a security measure designed to prevent unprivileged programs from impersonating critical services.
Most well-known ports map to protocols that are still in active, heavy use: HTTP on 80, HTTPS on 443, SSH on 22, DNS on 53. Port 99 is a reminder that not every early assignment found lasting adoption. The namespace has room for protocols that mattered briefly, or mattered in ways that were absorbed by later, better solutions.
Frequently Asked Questions
Was this page helpful?