77

Port 77/tcp is registered with IANA under the description "any private RJE service" with a blank service-name field, assignee and contact both [Jon_Postel], and no RFC reference (dual-registered on TCP and UDP). The "RJE" stands for Remote Job Entry, a 1960s–1970s mainframe-era convention for submitting batch processing jobs from remote workstations to a central host; the IANA label here is a deliberate catch-all rather than a single defined protocol, reserving the number for private/proprietary RJE implementations that never standardized. Because the assignment is generic and carries no specification document, any traffic seen on port 77 is implementation-specific by definition. The one named modern software that defaults to this port is the JAMS Agent (the Fortra/HelpSystems JAMS job scheduler, v7.x), which listens on 77/tcp for job-execution requests from the JAMS Scheduler server — a fitting, if coincidental, echo of the original "remote job entry" purpose; the port is configurable there. Internet exposure is minimal: Shodan's standard crawl list skips from port 70 to 79 and does not track 77 in its per-port banner dataset, and the port does not appear on commonly referenced "bad ports" or actively-exploited lists (Gary Kessler's bad-ports list, SANS ISC, FortiGuard). No CVE specifically targets port 77 and no named trojan or malware family is reliably associated with it in current threat intelligence — older "trojan port" pages note a historical association but name no specific malware and imply no current infection. For an analyst, a responsive port 77 most plausibly indicates a JAMS Agent or a private/legacy RJE-style service; because anything on it is non-standard, the prudent controls are firewall ACLs restricting it to trusted IPs, authentication, and TLS or VPN tunneling.

IANA assignment

service-name field blank; description "any private RJE service"; reference blank (no RFC cited); assignee and contact both [Jon_Postel]; dual-registered 77/tcp + 77/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, lines 178–179)

Range class

well-known (0–1023) [Confirmed]

Prevalence / exposure

very low internet footprint; Shodan does not track port 77 in its per-port banner dataset and its crawl list skips 70→79; not on common bad-ports or actively-exploited lists [Likely] — Shodan ports data; Gary Kessler bad-ports list; s0md3v bad-ports gist

Related ports

contrast with standardized job/batch and remote-exec services; small-services and legacy-reservation cluster

Primary use

catch-all reservation for private Remote Job Entry (RJE) implementations; RJE is a legacy mainframe batch-job-submission convention, not a single defined protocol

Other/unofficial uses

JAMS Agent (Fortra/HelpSystems JAMS scheduler, v7.x) listens on 77/tcp by default for job-execution requests from the JAMS Scheduler server (configurable)

Security implications

no port-specific CVE and no reliably named malware family; any service on it is non-standard, so reduced hardening baseline is plausible — restrict to trusted IPs (firewall ACL), require authentication, encrypt via TLS/VPN, apply rate limiting

Typically seen on

hosts running a JAMS Agent, or private/legacy RJE-style services; otherwise an anomaly worth investigating

Analyst note

A historical secondary report (portsmaster.org, Jan 2025) describes ~12,000 unsolicited connection attempts over three months against an unprotected custom service on this port, suggesting opportunistic scanners do probe it; this is unverified secondary reporting with no named source — treat as anecdotal.

Port 77/udp is registered with IANA as "any private RJE service" — a generic placeholder reservation rather than a named protocol. The registry assigns no service-name string for this row; the description column reads "any private RJE service," the assignee and contact are both [Jon_Postel], and the IANA Reference column is blank. RJE stands for Remote Job Entry, a legacy batch-processing mechanism for submitting jobs from remote terminals to mainframe computers (for example, IBM 360-series systems reached over the early ARPANET via NETRJS). The "any private" wording means the number was set aside for private, site-local RJE implementations rather than assigned to one defined service, so no RFC is tied to port 77 and the registry's Reference field is correctly empty. Port 77 is dual-registered: 77/tcp carries an identical "any private RJE service" entry with the same [Jon_Postel] assignee. In practice the port is effectively unassigned — RJE as a technology is obsolete and no maintained software claims this number by convention. For an analyst, any traffic on 77/udp in a modern environment is anomalous: with no active standardized service behind it, the port is occasionally repurposed for internal bespoke services, and at least one third-party reference has historically flagged port 77 in a trojan/malware context, though no specific malware family is confirmed to use it. Treat a responsive 77/udp as worth investigating rather than as a recognizable service.

IANA assignment

no service-name string assigned; description "any private RJE service"; assignee and contact both [Jon_Postel]; Reference column blank (no RFC) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, 77/udp row)

Range class

well-known (0–1023) [Confirmed] — port number 77

Dual registration

77/tcp carries an identical "any private RJE service" entry, same [Jon_Postel] assignee [Confirmed] — IANA registry (77/tcp row)

Registration / modification dates

not published in the registry — left blank, no date fabricated [Unknown] — IANA registry (blank columns)

Status

legacy / effectively unassigned in operational terms; IANA retains the generic reservation for both TCP and UDP [Confirmed] — IANA registry; portsmaster.org

Primary use

generic private-use reservation for Remote Job Entry (RJE) implementations; RJE is a legacy mainframe batch-job-submission mechanism (e.g., NETRJS on early ARPANET). No defined protocol or RFC is tied to port 77

Common software

no widely adopted or maintained software uses 77/udp by convention; one anecdotal report describes an unnamed SaaS provider relocating a proprietary config API to port 77 to avoid conflicts (bespoke/internal use, not standardized)

Security implications

not a high-value scan target in major threat-intel feeds; one third-party reference flags port 77 with a historical trojan/malware caveat but names no confirmed malware family; any 77/udp traffic in production is anomalous and warrants investigation

Analyst note

no recognizable service lives here; treat a responsive 77/udp as anomalous and investigate as bespoke/internal use, a decoy, or a backdoor rather than a standard service.