What Runs on Port 387
Port 387 carries AURP (AppleTalk Update-Based Routing Protocol), a routing protocol that encapsulates AppleTalk data inside IP packets.1 AURP routers — called tunnel endpoints — maintain AppleTalk routing tables and exchange routing updates via TCP or UDP on port 387.2
This is bridge technology. AppleTalk on one side, IP on the other, AURP in the middle making them speak.
How AURP Works
AURP does three things:1
- Tunnels AppleTalk traffic — Wraps AppleTalk data packets in IP packets so they can traverse IP networks
- Propagates routing information — Exchanges AppleTalk routing updates between routers connected through foreign networks
- Presents network information — Makes AppleTalk network data available to local nodes and Phase 2-compatible routers
Unlike RTMP (AppleTalk's chatty distance-vector protocol that broadcasts every 10 seconds), AURP only sends updates when the network topology actually changes.1 Less noise. More efficient.
The History — Keeping AppleTalk Alive
AppleTalk launched in 1985 with a radical idea: networking should work automatically.3 Plug in a Mac, it assigns its own address, discovers printers and file servers, configures routing. No IT department required. No manual IP configuration. It just worked.
This was revolutionary. But it was also proprietary.
By the early 1990s, TCP/IP was everywhere. The Internet was growing. Organizations needed to connect AppleTalk networks across IP-based wide area networks. Apple couldn't ignore IP anymore.
Enter AURP. Documented in RFC 1504 in August 1993 by A. Oppenheimer from Apple Computer.1 The protocol let AppleTalk networks extend across IP infrastructures without abandoning Apple's plug-and-play design philosophy.
AURP routers became translators — AppleTalk-speaking on the local network, IP-speaking on the WAN, maintaining the illusion that everything was still one seamless AppleTalk Internet.
Why This Port Matters (and Doesn't Anymore)
Port 387 represents a specific moment in networking history: the transition period when proprietary protocols met the unstoppable rise of IP.
AppleTalk Phase 2 (1989) had made the protocol more scalable — supporting more than 255 devices per network, flexible zones, better performance.3 But no amount of enhancement could compete with the universality of TCP/IP.
By 2009, Apple officially dropped AppleTalk support in Mac OS X v10.6.3 The protocol that once powered every Mac network quietly disappeared.
Port 387 still exists in the IANA registry. But it's a memorial now. A reminder that even elegant, auto-configuring protocols lose to standards with network effects.
The Genuine Strangeness
AURP was a protocol designed to keep one networking stack alive by hiding it inside another. AppleTalk data, wrapped in IP packets, traversing the very infrastructure that was replacing it.
This is what adaptation looks like in protocol terms. Not a clean migration. A tunneling strategy. A way to buy time while the inevitable happens.
Every AURP packet on port 387 was both a bridge and a countdown timer.
Security Considerations
AURP is obsolete. If you see traffic on port 387 today, you're either dealing with legacy Apple hardware from the 1990s or something masquerading as AURP.
Modern networks don't run AppleTalk. Modern Macs don't support it. If port 387 is open on your network, ask why.
How to Check What's Listening
On Linux or macOS:
On Windows:
You probably won't find anything. And that's appropriate.
Related Ports
- Port 201-202 — AppleTalk Routing Maintenance (RTMP)
- Port 204 — AppleTalk Echo Protocol (AEP)
- Port 206 — AppleTalk Zone Information Protocol (ZIP)
All ghosts of the same era.
Frequently Asked Questions
Bu sayfa faydalı oldu mu?