Port 812: NetInfo — A ghost from Mac OS X's past

What Port 812 Was For

Port 812 was used by NetInfo, a directory service that ran on Mac OS X systems from version 10.0 (released in 2001) through 10.4 Tiger (2005).¹²

NetInfo was Apple's way of storing system configuration data in a hierarchical database. User accounts, group memberships, network settings, printer configurations, mounted filesystems—NetInfo held it all. Processes running on your Mac queried NetInfo over RPC (Remote Procedure Call) to find out who could log in, what printers existed, and how the network was configured.

Port 812 was part of the range (600-1023) used by Mac OS X RPC-based services.¹ When NetInfo needed to communicate across a network, port 812 was one of the doors it used.

What Happened to NetInfo

With Mac OS X 10.5 Leopard in 2007, Apple killed NetInfo entirely. Open Directory replaced it—a more standards-based approach using LDAP and other directory protocols.²

NetInfo is gone. Modern macOS systems don't run it, don't need it, and wouldn't recognize a NetInfo query if they received one. Port 812 is a historical artifact.

The Well-Known Range

Port 812 sits in the well-known ports range (0-1023), ports assigned by IANA for system-level services.³ These are supposed to be the Internet's core infrastructure—the ports that require root or administrator privileges to use because they run essential services.

Most well-known ports carry protocols the Internet depends on. Port 80 for HTTP. Port 443 for HTTPS. Port 53 for DNS. Port 22 for SSH.

Port 812 carried something that mattered once, then disappeared. Not every port in the well-known range survived into the modern Internet.

Checking What's Listening

On macOS, Linux, or any Unix-like system:

lsof -i :812

This shows any process listening on port 812. On a modern Mac, you'll see nothing. NetInfo is dead.

On Windows:

netstat -an | findstr :812

Same result. Nothing should be listening here unless you're running something very old or very unusual.

Why This Port Matters

Port 812 is a reminder that the well-known ports range isn't static. Services get created, become essential, then vanish. The port numbers remain.

If you see traffic on port 812 today, you're either looking at:

• An extremely old Mac OS X system (10.0-10.4) still running NetInfo
• Something else using the port unofficially
• A misconfiguration or security scan

NetInfo died nearly two decades ago. If port 812 is active on your network, something strange is happening.