Port 781: hp-collector — A ghost from HP's data center empire

Port 781 is officially assigned to hp-collector (HP performance data collector) for both TCP and UDP. It was part of HP OpenView, an enterprise systems management suite that monitored network and system performance across large corporate environments.

The software is obsolete. HP OpenView was rebranded in 2007 and gradually phased out. But the port assignment remains in IANA's registry—a permanent marker of infrastructure that mattered in the 1990s and early 2000s.

What hp-collector Did

The HP performance data collector gathered metrics from managed systems—CPU usage, memory consumption, disk I/O, network traffic. It ran on management servers and queried agents installed on monitored nodes, collecting data every few minutes and storing it for analysis.¹²

Port 781 was one of several ports used by HP OpenView components. Port 381 was the primary port for the performance collector service, while 781 appears to have been used for related collection functions.³

The data helped IT teams spot performance bottlenecks, track capacity trends, and troubleshoot problems before users noticed. In the era before cloud infrastructure and modern observability tools, this was how enterprises kept their data centers running.

The Well-Known Range

Port 781 sits in the well-known ports range (0-1023), which IANA reserves for standard system services. These ports require special privileges to bind on Unix-like systems—you need root access to listen on port 781.

This made sense when HP OpenView was critical infrastructure. System administrators installed it on dedicated management servers with the necessary permissions. But now it's a legacy assignment, taking up space in the most privileged range of the port system.

What Runs Here Now

Almost nothing. HP OpenView hasn't been actively developed or sold in years. If you find something listening on port 781, it's likely one of three things:

1. A legacy HP OpenView installation that somehow survived multiple infrastructure migrations
2. A different service repurposing the port because the administrator didn't know it was assigned
3. Malware using an obscure port hoping no one is watching

You can check what's listening with:

# Linux/macOS
sudo lsof -i :781
sudo netstat -tuln | grep 781

# Windows
netstat -ano | findstr :781

If you find something running on port 781 and you're not running ancient HP management software, investigate. It shouldn't be there.

Why Unassigned Ports Matter

Wait—port 781 is assigned. But it's assigned to something nobody uses, which raises a question: should IANA reclaim obsolete port assignments?

The well-known range is finite. Only 1,024 ports exist in this privileged space, and once assigned, they tend to stay assigned forever. Port 781 will likely remain reserved for hp-collector long after the last HP OpenView installation is finally decommissioned.

This is the nature of registries. They preserve history. Port 781 isn't just a number—it's proof that HP OpenView existed, that it mattered enough to warrant an official assignment, that enterprises once depended on it.

And maybe that's worth preserving. Every ghost port tells a story about what we built, what we replaced, and what we forgot we were running.

Security Considerations

If you're not running HP OpenView (and you probably aren't), port 781 should be closed. Having it open serves no purpose and creates unnecessary attack surface.

Older HP OpenView installations had known vulnerabilities, and the software is no longer patched. If you inherited a system with port 781 open, either you're running legacy infrastructure that desperately needs upgrading, or something else is using that port.

Either way, investigate.