Port 742: netrcs — A Port with Multiple Lives

Port 742 sits in the well-known port range (0-1023) but doesn't have the clear story that most ports in this range carry. It's been officially assigned, used by Apple, borrowed by malware, and largely forgotten.

What Runs on Port 742

According to IANA assignment records, port 742 is designated for netrcs—a Network-based Revision Control System.¹ The protocol was designed to handle version control operations over the network, managing multiple revisions of files remotely.

In practice, you're unlikely to encounter netrcs traffic in 2026. The protocol never achieved widespread adoption, and modern version control systems like Git operate differently.

The Apple Connection

Port 742 was also used by NetInfo, Apple's RPC-based directory service in Mac OS X.² NetInfo used ports in the 600-1023 range for RPC services, and port 742 was among them.

NetInfo is long dead. Apple deprecated it years ago in favor of Open Directory and other modern directory services. But the port assignment remains, a fossil in the IANA registry.

The Security Flag

Port 742 appears in security databases because trojans and viruses have used this port in the past to communicate.³ This doesn't mean current traffic on port 742 is malicious—it means you should investigate rather than ignore.

Malware often borrows legitimate port numbers precisely because they're already assigned. A trojan using port 742 looks slightly less suspicious than one using a random high-numbered port. The presence of traffic on this port requires context: Is this a Mac running legacy software? An old netrcs installation? Or something else entirely?

What Well-Known Ports Mean

Port 742 belongs to the well-known port range (0-1023), which is controlled by IANA. Only system processes or programs executed by privileged users can bind to these ports on most operating systems. This provides a layer of protection—random applications can't hijack port 742 without elevated permissions.

Well-known ports were assigned during the early Internet when the list was short and applications few. Many assignments, like port 742, reflect protocols that never achieved widespread use or have since been replaced by better alternatives.

Checking What's Listening

On Linux or macOS:

sudo lsof -i :742

On Windows:

netstat -ano | findstr :742

If you see something listening on port 742, investigate what it is. Legitimate uses in 2026 are rare but not impossible—legacy Apple systems or obscure revision control setups might still use it.

Why Unassigned and Forgotten Ports Matter

Port 742 isn't technically unassigned—it has an official designation. But it's functionally abandoned. The protocol it was meant for never thrived, and the Apple service that borrowed it is dead.

These ports matter because they remind us that the Internet has history. Port numbers are finite resources, assigned when someone thought they'd serve a purpose. Some became essential (port 443 for HTTPS). Others became footnotes (port 742 for netrcs).

The security implications matter too. Forgotten ports are attractive to malware precisely because they're forgotten. No legitimate service means any traffic is suspicious. An assigned-but-unused port is more dangerous than an unassigned one—it has the veneer of legitimacy without the scrutiny of active use.

The Messy Reality

Port 742 doesn't have a clean narrative. It was assigned to netrcs, used by NetInfo, borrowed by trojans, and is now mostly quiet. That's the reality of well-known ports outside the famous ones—they accumulate history, serve multiple purposes, and sometimes fade into obscurity.

If you see traffic on port 742, don't assume malware. But don't assume legitimacy either. Context matters. The port's complicated history means you need to investigate before deciding what's really happening.