Port 407: Timbuktu — The Ghost of Remote Control Past

What This Port Does

Port 407 is officially assigned to Timbuktu, a remote control software product that allowed users to view and control another computer across a network.¹ When Timbuktu was running, port 407 handled the initial connection setup for remote screen sharing, file transfers, and remote administration.

The software is dead. Port 407 remains assigned to it anyway.

The Protocol

Timbuktu originally used UDP port 407 for connections (versions 5.1 and earlier), then switched to TCP port 407 in later versions (5.2+).² The protocol allowed:

• Remote screen viewing and control
• File transfers between computers
• System profiling and monitoring
• Voice and text chat
• Remote activity notifications

Think of it as a precursor to VNC, Remote Desktop, and every screen-sharing tool you use today.

The History

Timbuktu was first developed in the late 1980s by WOS Data Systems as a Macintosh product.³ In a time when most people had never heard of networking, Timbuktu let you control another Mac over AppleTalk. Watch another screen. Move files between machines. Control a computer in another room like you were sitting in front of it.

WOS Data Systems was purchased by Farallon Computing in July 1988.³ In 1993, Farallon released Timbuktu Pro, which added TCP/IP support—meaning you could control computers over the Internet, not just local networks.⁴ This was before the web browser became ubiquitous. This was when the Internet was still mostly text.

A Windows version followed. The software passed through multiple owners: Farallon became Netopia in 1999, which was acquired by Motorola in 2007, which eventually became part of Arris.³

On April 28, 2015, Arris sent an email to customers: development of Timbuktu was ending. Sales would stop in 90 days.³

The software disappeared. Port 407 did not.

Why This Port Matters

Port 407 is a memorial. IANA still lists it as assigned to Timbuktu, even though the software no longer exists.¹ The port sits in the well-known range (0-1023), reserved for protocols and services deemed important enough to merit permanent assignment.

Most well-known ports serve protocols still in active use: HTTP on 80, HTTPS on 443, SSH on 22. Port 407 serves nothing. It's a tombstone in the registry—a reminder that the Internet remembers even when the software doesn't.

This happens more often than you'd think. Ports get assigned to protocols that fade into obsolescence. The assignments remain because changing them would be more confusing than leaving them alone. Better to have a known ghost than an unknown squatter.

Security Considerations

If you see traffic on port 407 today, be suspicious. Legitimate Timbuktu traffic is unlikely given the software was discontinued in 2015 and is no longer supported or updated.

Check what's listening:

# On Linux/Mac
sudo lsof -i :407
sudo netstat -tulpn | grep :407

# On Windows
netstat -ano | findstr :407

If something is using port 407, it's either:

• Legacy Timbuktu installations (security risk—old, unpatched software)
• Malware or unauthorized remote access tools masquerading as legitimate services
• Custom applications repurposing the port

None of these are good. Investigate immediately.

Related Ports

• Port 5900: VNC (Virtual Network Computing) - the spiritual successor to remote control software like Timbuktu
• Port 3389: Remote Desktop Protocol (RDP) - Microsoft's remote access protocol
• Port 5631-5632: PCAnywhere - another early remote control application, also discontinued