# WHATPORT(3031)

## NAME

port 3031 — Remote AppleEvents (eppc) — macOS Program Linking — remote AppleEvents, meaning remote AppleScript execution.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

Port 3031 is IANA-registered as `eppc`, Remote AppleEvents/PPC Toolbox, and macOS still uses it for exactly that: when "Remote Apple Events" is enabled in Sharing settings, the Mac accepts AppleEvents from other machines and runs them as an authenticated local user. Apple lists it in its own port reference as TCP and UDP 3031. It is off by default and rare in the wild, so an open 3031 means somebody deliberately turned Program Linking on. The practical effect is scripted remote control of applications on that Mac.

## EXPOSURE

**Do not expose.** This is remote code execution by design, gated only by an account password — keep it off, or confine it to a trusted LAN behind a VPN.

## CHECK

```sh
nc -vz TARGET 3031
```

## SEE ALSO

- docs — [Apple Support — TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229) (support.apple.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/3031/> · JSON: <https://whatport.net/3031.json> · full dataset: <https://whatport.net/ports.json>