Port 713: IRIS-XPC — The Protocol That Tried to Replace WHOIS

Port 713 carries IRIS-XPC (Internet Registry Information Service over XML Pipelining with Chunks), a protocol designed to answer questions like "who owns this domain?" or "what organization controls this IP address?" It was built to replace WHOIS, the Internet's phonebook from the 1980s.

It didn't succeed. But the story of why it exists reveals something important about the difficulty of modernizing infrastructure that already works.

What IRIS-XPC Does

IRIS-XPC is a query protocol for Internet registry information. You ask questions about domains, IP addresses, or network resources. The server responds with structured XML data.

The "XPC" part—XML Pipelining with Chunks—is the innovation. Instead of sending an entire XML response as one massive blob, the server sends it in chunks. The client can start processing the first chunk while the rest are still arriving. For large responses, this means faster results.

The technical mechanism: each data block starts with a one-octet header. Chunks within the block carry flags indicating "last chunk" (LC) and "data complete" (DC). The client knows when it can start acting on partial data and when the full response has arrived.¹

Why It Was Created

In the early 1980s, WHOIS was the way you found information about domain registrations and IP allocations. You sent a plaintext query. You got back plaintext results. No structure. No standards. Different WHOIS servers returned different formats for the same query.²

By the early 2000s, this was a problem:

• No consistency — Every registry formatted responses differently
• No internationalization — WHOIS was English-centric and ASCII-only
• Privacy concerns — All information was public by default
• No extensibility — Adding new data types meant breaking existing parsers

The IETF's Cross Registry Internet Service Protocol (CRISP) working group created IRIS to solve these problems. Published in RFC 3981 (core protocol) and RFC 4992 (XPC transport), IRIS offered:

• Structured XML instead of freeform text
• Multiple transport protocols (XPC, BEEP, LWZ)
• Defined schemas for different registry types (domains, IP addresses)
• Pipelined responses for better performance³

Port 713 was assigned to IRIS-XPC as its well-known port.

What Actually Happened

IRIS failed to replace WHOIS. Not because it was technically inferior—it was technically better in almost every way. It failed because:

Inertia is powerful. WHOIS already worked. Every tool, script, and system that needed registry information already spoke WHOIS. Migrating to a new protocol required coordinated effort across thousands of organizations. That coordination never materialized.

Good enough beats perfect. WHOIS is clunky and inconsistent, but developers had already built parsers to handle the inconsistency. The pain wasn't acute enough to justify the cost of switching.

New problems emerged. By the time IRIS was standardized, privacy concerns about public WHOIS data led to new regulations (GDPR) that fundamentally changed what information could be displayed. The problem space shifted.

Port 713 sits mostly idle today. WHOIS continues on port 43, unchanged, carrying plaintext queries and responses just like it did in 1982.

How to Check What's Listening

On Linux or macOS:

# See if anything is listening on port 713
sudo lsof -i :713

# Or using netstat
netstat -an | grep 713

On Windows:

netstat -ano | findstr :713

You probably won't find anything. IRIS-XPC never achieved widespread deployment.

Security Considerations

Because port 713 is rarely used, finding it open on a system is worth investigating:

• Misconfigurations — A service might be misconfigured to listen on 713
• Malware — Unused ports are sometimes claimed by malicious software precisely because they're unexpected
• Legitimate but rare — Some research or registry testing systems might actually run IRIS-XPC

If you find port 713 open and weren't expecting it, verify what process owns it and why.

The Well-Known Port Range

Port 713 belongs to the well-known ports range (0-1023), assigned by the Internet Assigned Numbers Authority (IANA). These ports are reserved for standard Internet services and require root/administrator privileges to listen on in most operating systems.

Being assigned a well-known port signals importance—these are meant for fundamental Internet protocols. Port 713 was given this designation because IRIS was expected to become fundamental. The expectation didn't match reality.

What This Port Teaches Us

Port 713 is a monument to the difficulty of replacing working infrastructure. The technically superior solution doesn't always win. Coordination costs matter. Deployed systems have enormous inertia.

WHOIS still runs on port 43, four decades later, because good enough beats perfect when "perfect" requires the world to change simultaneously. Port 713 carries the protocol that tried to make that happen—and learned that sometimes, the old thing wins.

Related Ports

• Port 43 — WHOIS, the protocol IRIS-XPC tried to replace, still dominant
• Port 3901 — IRIS-BEEP, another IRIS transport protocol (also rarely used)
• Port 715 — cobbler, another obscure protocol in the well-known range