Port 9996: Palace-5 — The Port That Carried Virtual Worlds

Port 9996 sits in the registered port range (1024-49151) and is officially assigned to "palace-5"—the service name for The Palace virtual reality chat software.¹²

What Runs on This Port

The Palace is a graphical chat environment created by Jim Bumgardner at Time Warner in 1994 and released to the public in November 1995.³ Unlike text-based IRC or web forums, The Palace rendered visual chat rooms: bitmap backgrounds where users appeared as customizable avatars and communicated via text displayed in comic-style speech bubbles.

When you connected to a Palace server on port 9996, you entered a persistent virtual space. You could walk between rooms, change your avatar, whisper to other users, and watch the room populate in real-time as other people connected.

The protocol handles:

• Avatar position and movement updates
• Chat messages and speech bubble rendering
• Room transitions and bitmap loading
• User presence and status information

Both TCP and UDP can be used on port 9996, though TCP is more common for the core Palace protocol.⁴

The History: Virtual Reality in 1995

The Palace emerged in the mid-1990s when "virtual reality" meant something different. Not headsets or 3D engines—just the radical idea that the Internet could contain persistent spaces where you had a visible presence.

Jim Bumgardner created The Palace as a demonstration project for interactive cable television in 1994. Internal testers at Time Warner became so engaged with the prototype that the company released it as a standalone application. Public beta began in September 1995, with official launch in November.³

This was before Second Life, before MMORPGs went mainstream, before social media existed. The Palace was one of the first attempts to answer the question: What does it mean to hang out somewhere on the Internet?

Users created elaborate avatars, decorated rooms, built communities. Palace servers became destinations. Some ran continuously for years, accumulating their own culture, inside jokes, regular inhabitants.

What Made It Strange

The Palace had no central authority controlling all servers. Anyone could run a Palace server. The software was distributed freely. You could host your own world on port 9996, design your own rooms, set your own rules.

This meant the Palace universe was fragmented and diverse. Every server had its own character. Some were family-friendly hangouts. Some were anarchic. Some became digital art projects. Some were just empty rooms waiting for someone to show up.

The bitmap aesthetic—low-resolution backgrounds, small avatar graphics—wasn't a limitation. It was the style. Users created intricate avatar designs pixel by pixel. The constraints made creativity visible.

The Palace Today

Here's the genuinely remarkable thing: The Palace still exists. Servers are still running. You can download the client, connect to port 9996, and enter rooms that have been operating since the late 1990s.⁵

The protocol hasn't changed. The port is the same. The experience is essentially identical to 1995. This is what persistence looks like on the Internet: not constant updates and redesigns, but a protocol that works and keeps working.

Active Palace communities still exist. People still create avatars. Rooms still fill up. The population is smaller, but the world is still there, still accessible on the same port it's used for nearly 30 years.

Other Uses for Port 9996

Port 9996 is also used by MiniSoft's eFORMz Director service, a document processing and form management system.⁶ This is common in the registered port range—multiple applications can use the same port number unofficially, though only one service can bind to a port on a given system at a time.

Security Considerations

Port 9996 has been associated with trojans and malware in the past.⁷ This doesn't mean The Palace protocol is malicious—it means attackers have used this port number for command-and-control communication, likely because it's less commonly monitored than well-known ports.

If you're not running a Palace server or eFORMz, port 9996 should not be listening. Check what's using this port:

# Linux/Mac
sudo lsof -i :9996
sudo netstat -tlnp | grep 9996

# Windows
netstat -ano | findstr :9996

If something unexpected is listening on 9996, investigate. Legitimate Palace servers will identify themselves clearly.

Why This Port Matters

Port 9996 represents something important: the Internet's capacity for persistence. Not everything needs to be constantly updated, redesigned, reimagined. Sometimes a protocol works and keeps working. Sometimes a community forms and keeps forming.

The Palace is still there. The port is still open. The rooms are still lit. You can still walk in.

That's what port 9996 carries: the possibility that digital spaces can endure, that virtual worlds can have the same longevity as physical places, that what we build on the Internet can last.

Related Ports

• Port 6667: IRC (Internet Relay Chat)—text-based chat from the same era
• Port 5190: AOL Instant Messenger (AIM)—another 1990s chat protocol
• Port 6346: Gnutella—peer-to-peer networks from the same period