Common attacks and weaknesses
- Enumeration of RPC services.
- DDoS amplification over UDP.
Port 111: rpcbind
ONC RPC port mapper, used by NFS.
111
How rpcbind works
Network servicesThe client sends a request to port 111 and the rpcbind service answers. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Network services
Is port 111 dangerous?
How to secure it
- Block at the edge; disable when NFS is not used.
IANA registry entries for port 111
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| sunrpc | 111 | TCP, UDP | SUN Remote Procedure Call | - | - |
// source: IANA service name and port number registry
Which program uses port 111, and is it reachable?
Linux
sudo ss -ltnup 'sport = :111' # process listening on 111
sudo lsof -nP -i :111macOS
sudo lsof -nP -i :111
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 111 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 111 netstat -ano | findstr :111
From another machine
nmap -p 111 -sV <host> sudo nmap -sU -p 111 <host> nc -zv <host> 111
Block it in the firewall
sudo ufw deny 111/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 111" -Direction Inbound -LocalPort 111 -Protocol TCP -Action Block # Windows
What is port 111 used for?
ONC RPC port mapper, used by NFS.
Is port 111 TCP or UDP?
Port 111 is registered for TCP and UDP.
Is it safe to open port 111?
It is rated 6/10 (high) when exposed to the Internet. Enumeration of RPC services. Block at the edge; disable when NFS is not used.
How do I check if port 111 is open?
On Linux run "ss -ltnup 'sport = :111'", on macOS "lsof -nP -i :111", and on Windows "netstat -ano | findstr :111" to see the local process. From another machine, "nmap -p 111 <host>" shows whether it is reachable.
Other network services ports
:53 DNS tcp · udp · moderate risk :135 MS RPC tcp · udp · high risk :123 NTP udp · tcp · moderate risk :67 DHCP server udp · tcp · moderate risk :9100 Raw printing (JetDirect) tcp · udp · high risk :631 IPP / CUPS tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk :5355 LLMNR udp · tcp · high risk