101
Summary
- // if you see it open
- Obsolete, superseded by DNS (port 53), with a minimal modern footprint. A port-101 listener today is more likely a mislabeled or repurposed service than a genuine NIC hostname server.
- // analyst note
- An open 101 almost never indicates a live NIC hostname service today; fingerprint what is actually listening.
About port 101/tcp.
Port 101/tcp is registered with IANA as hostname with the description "NIC Host Name Server," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP; some /etc/services files list the alias hostnames). The service is the SRI-NIC host-name service from the hosts.txt era: before DNS, every host on the early internet relied on a centrally maintained HOSTS.TXT file downloaded from the Network Information Center, and this service answered host-name queries against the NIC's master table. The IANA reference field is blank. It was rendered obsolete by the Domain Name System (port 53), which replaced the unscalable central-file model with a distributed, hierarchical, delegated namespace; the NIC hostname service has had no meaningful role for decades. Security-wise there is little to say beyond obsolescence — an open 101 has a minimal modern footprint and is essentially a historical curiosity, and in practice a port-101 listener today is more likely a mislabeled or repurposed service than a live NIC hostname server. For an analyst, an open 101 almost never indicates a genuine NIC host-name service; the useful step is to fingerprint what is actually listening on the port rather than to assume the registered service is present.
- IANA assignment
hostname— "NIC Host Name Server"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 101/tcp + 101/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- very low open-frequency in nmap-services (de-facto) [Well-established] — nmap-services file
- Related ports
- 53 (DNS), 42 (Host Name Server)
Primary use
NIC host-name lookup against the hosts.txt master table (pre-DNS) [Well-established]
Other/unofficial uses
effectively none today; obsolete [Well-established]
Security implications
obsolete; minimal modern footprint; a port-101 listener today is likely mislabeled/repurposed rather than a live NIC service [Well-established]
Typically seen on
very old NIC-era hosts; otherwise anomalous
- Analyst note
- An open 101 almost never indicates a live NIC hostname service today; fingerprint what is actually listening.
About port 101/udp.
Port 101/udp is registered with IANA as hostname with the description "NIC Host Name Server," assignee and contact both [Jon_Postel], and every remaining registry column — Registration Date, Modification Date, Reference, Service Code, Unauthorized Use Reported, Assignment Notes — left blank (dual-registered on TCP and UDP). The only protocol specification tied to this name is RFC 953, "Hostname Server" (K. Harrenstien, M. Stahl, E. Feinler, SRI-NIC, October 1985), which describes the service the Defense Data Network Network Information Center (DDN NIC) at SRI International ran to distribute the ARPANET/DDN host table: a client opens a connection to port 101, issues a query, and the server returns host records and closes the connection. Notably, RFC 953 specifies TCP transport, not UDP — so while IANA reserves the name on both transports, no authoritative specification describing an actual UDP variant of the hostname protocol on port 101 was found. The UDP registration reads as a paired/reserved entry rather than an independently documented protocol. This service predates and was operationally superseded by the Domain Name System; the centralized SRI-NIC host-table model it served was retired as DNS took over host-name resolution. For an analyst, a responsive UDP/101 today is an anomaly rather than a live standard service: there is no known modern software that speaks a UDP hostname protocol on this port, and no scanning, exposure, malware, or CVE data specific to UDP/101 was found in this pass. The IANA Reference field is blank and is left blank here — RFC 953 is cited in prose as historical background only, not as the registry's reference for this assignment.
- IANA assignment
hostname— "NIC Host Name Server"; reference (blank — no RFC cited in IANA registry); assignee/contact[Jon_Postel]; dual-registered 101/tcp + 101/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cache the IANA Service Name and Transport Protocol Port Number Registry line 270; TCP counterpart line 269)- Range class
- well-known (0–1023) [Confirmed]
- IANA Reference / RFC
- blank in the registry — no RFC cited for this assignment; do not invent one. RFC 953 documents a same-named TCP protocol but is not the registry Reference [Confirmed] — IANA registry; RFC 953
- Registration / modification date
- Unknown (blank in the source registry) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 270
- Dual registration
- 101/tcp is registered identically as
hostname/ "NIC Host Name Server," same assignee[Jon_Postel], all other columns blank [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 269 - Related ports
- 42/tcp+udp (nameserver / host name server, WINS), 53/tcp+udp (DNS — the successor to NIC host-table resolution), 43/tcp (whois — the other SRI-NIC lineage service)
Primary use
historical/legacy NIC host-table distribution service; the only protocol spec (RFC 953, Oct 1985) defines a TCP query/response service run by SRI-NIC — no UDP variant is documented, so real-world UDP/101 protocol behavior is Unknown
Common software
Unknown — no current or historical software beyond the original 1980s SRI-NIC host-table implementation was found bound to UDP/101 specifically [Unknown]
Exposure / scanning / malware
Unknown — no scan-volume, Shodan, honeypot, malware, or CVE data specific to UDP/101 was found; given the service's legacy/inactive status, exposure is expected to be rare, but this is an inference, not a sourced measurement [Unknown]
Typically seen on
not associated with any known active service; a responsive UDP/101 is an anomaly worth investigating
- Analyst note
- a live UDP/101 is statistically rare and legacy; RFC 953 describes only a TCP service, so treat any UDP responder as undocumented and investigate rather than assume standard behavior.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| hostname | UDP | hostnames NIC Host Name Server | 0.06% |
| hostname | TCP | hostnames NIC Host Name Server | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.