Port 2971: NetClip — the clipboard that crosses the room

Before AirDrop, before universal clipboard in iCloud, before any of the polished solutions that exist today, there was a problem: you had two computers on your desk and no good way to move a snippet of text between them.

Email it to yourself. Create a shared note. Open a chat window. All of it feels absurd for something as simple as "I just copied this on my laptop and I want it on my desktop."

Port 2971 is registered with IANA for NetClip, a network clipboard daemon built to solve exactly this. It's small, honest software doing one thing.

How NetClip Works

When you copy something, NetClip broadcasts a message to the local network's broadcast address: "I have clipboard content. Who wants it?" Any other machine running NetClip hears the broadcast, opens a TCP connection back to the sender, and fetches the content.

The data is encrypted with AES using a pre-shared secret key configured across all participating machines. The developer is upfront that this is custom cryptography — not TLS — with known limitations like static salts and no forward secrecy. Fine for a home network, worth knowing for anything more sensitive.¹

NetClip runs on macOS, Windows, and Linux. It's Java-based, which is either reassuring (cross-platform) or concerning (Java), depending on your history with Java.

The Port's Registration

Port 2971 is a registered port (range 1024–49151), meaning it sits in the space where services apply to IANA for a named assignment. IANA lists it for both TCP and UDP under the service name netclip.²

The registered assignee is Rudi Chiarito. Not a company — a person. Someone had a problem, built a tool, and registered a port for it. This happens more than you'd think in the registered range.

Checking What's Listening on This Port

If you see traffic on port 2971 and you didn't set up NetClip, it's worth a look:

# macOS / Linux
lsof -i :2971

# Windows
netstat -ano | findstr :2971

The registered range has enough obscure software assignments that unexpected activity on any port in this range usually has a mundane explanation. But checking takes ten seconds and is always worth doing.