497

Port 497/tcp is registered with IANA today as retrospect with the description "Retrospect backup and restore service," assignee Retrospect, Inc. (contact JG Heithcock), a modification date of 2012-02-02, and a blank reference field (dual-registered on TCP and UDP). A historical note matters here: older IANA and /etc/services data listed this assignment as the service dantz with contact Richard Zulch, and the 2012 update renamed it to retrospect under Retrospect, Inc. as the product passed from Dantz Development through EMC and Roxio to Retrospect, Inc. Its purpose is the proprietary client/server communication for Retrospect backup software — scheduling, client authentication, coordinating data transfer, and snapshots and restores. Retrospect uses well-known port 497 on both TCP and UDP per its own knowledge base, plus subnet broadcast and a multicast "Piton Name Service" on address 224.1.0.38 for client discovery, all over a proprietary protocol. The IANA reference field is blank. Security-wise backup infrastructure is a high-value target because it touches all protected data, and the Retrospect client historically had multiple DoS and information-leak vulnerabilities reachable on TCP 497 — for example iDefense's 2006 advisory on the EMC Dantz Retrospect 7 client, in which malformed packets crash the client and some versions sent a password hash in cleartext, fixed in 7.0.109 / 6.5.138 — though prevalence is low today. For an analyst, an open 497 indicates a Retrospect backup endpoint, and because backup systems are prized targets, it is worth confirming the host is internal and patched.

IANA assignment

retrospect — "Retrospect backup and restore service"; reference (blank — no RFC cited in IANA registry); assignee Retrospect, Inc. (contact JG Heithcock); modification date 2012-02-02; historically the dantz entry (contact Richard Zulch); dual-registered 497/tcp + 497/udp

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low but non-trivial; nmap-services open-frequency ~0.001179 (de-facto) [Well-established] — nmap-services file

Related ports

multicast 224.1.0.38 (Piton); conceptually grouped with other backup-software ports

Primary use

Retrospect backup client/server communication (scheduling, auth, data transfer, restores)

Other/unofficial uses

Piton Name Service multicast 224.1.0.38 for client discovery [Well-established]

Security implications

backups are high-value targets; historical Retrospect client DoS/info-leak vulns on 497 (iDefense 2006, EMC Dantz Retrospect 7; fixed 7.0.109/6.5.138) [Well-established/Threat-reported]

Typically seen on

Retrospect backup servers/clients

Analyst note

An open 497 indicates a Retrospect backup endpoint; because backup systems are prized targets, confirm it is internal and patched.

Port 497/udp carries traffic for Retrospect, backup and restore software published by Retrospect, Inc. (formerly Dantz Retrospect); it should stay restricted to trusted internal network segments rather than be exposed to the public internet, since it exists purely so a backup server can reach its own clients on a LAN.

IANA registers port 497 as retrospect — "Retrospect backup and restore service" — on both TCP and UDP, assigned to Retrospect_Inc with contact JG Heithcock and a blank Reference column. The entry carries no backing RFC, and the registry's own metadata shows a modification date of 2012-02-02.

Retrospect's own support documentation confirms the assignment first-hand: administrators are told to open UDP and TCP port 497 through the firewall so a Retrospect backup server and its clients can communicate, alongside multicast address 224.1.0.38 used for client discovery on the local subnet.

Prevalence data from the project's port-data.json (built from nmap-services) puts 497/udp's open-frequency at 0.017348 (~1.7%), notably higher than most obscure registered ports, while 497/tcp sits at 0.001179 (~0.12%). This split fits UDP discovery/broadcast traffic being more commonly observed open than the TCP job-execution channel.

IANA assignment

retrospect — "Retrospect backup and restore service"; reference (blank — no RFC cited); assignee Retrospect_Inc (contact JG Heithcock); dual-registered 497/tcp + 497/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry retrospect 497/udp

Range class

well-known / system (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 497/udp = 0.017348 (~1.7%); 497/tcp = 0.001179 (~0.12%) [Confirmed] — this site's own tooling

Related ports

497/tcp (same service, dual-registered) [Confirmed]

Primary use

client/server communication between a Retrospect backup server and its backup clients — scheduling, execution, and management of backup/restore jobs

Other/unofficial uses

none found beyond the vendor's own multicast client-discovery use at 224.1.0.38 alongside the unicast port

Security implications

vendor documentation instructs opening this port only between trusted backup server/client pairs on internal networks; no CVE specific to the port found as of August 2026; malware association unconfirmed either way

Typically seen on

hosts running Retrospect backup server or client software (Mac/Windows)

Analyst note

An open 497/udp outside a known Retrospect deployment is unexpected — confirm against the host's software inventory rather than treating it as internet-facing.