105

Port 105/tcp is unusual in the IANA Service Name and Transport Protocol Port Number Registry because it carries two co-registered service names rather than one: cso, described as "CCSO name server protocol" (assignee Martin Hamilton), and csnet-ns, described as "Mailbox Name Nameserver" (assignee Marvin Solomon). Both names are dual-registered on 105/tcp and 105/udp, and both leave the Registration Date, Modification Date, and Reference columns blank in the cached registry, so no RFC is cited and no assignment date is recorded — those fields stay blank here rather than being invented. The historically significant use is CCSO: the CCSO Nameserver, implemented as the Qi server and Ph client, was an early plaintext directory-lookup service developed by Steve Dorner at the University of Illinois Urbana-Champaign's Computing and Communications Services Office. It let users query email addresses, phone numbers, and department information — a precursor to LDAP — with development beginning around 1988, active use from roughly 1991, and the architecture later documented in RFC 2378 ("The CCSO Nameserver (Ph) Architecture," September 1998). Note that RFC 2378 is not cited as the registry's Reference for the port assignment, so the IANA Reference field is left blank rather than populated with it. The second registration, csnet-ns, is an even more obscure legacy assignment from the CSNET era and is essentially undocumented beyond the registry line — its usage detail is Unknown. For an analyst, port 105 today is a legacy relic: CCSO is largely obsolete and superseded by LDAP, though a small number of Ph/Qi servers were reportedly still reachable as of 2020. No CVE or documented exploit specific to the CCSO/Ph/Qi protocol or to csnet-ns was surfaced in this pass, so security history is best stated as a sourced null (none found) rather than confirmed-absent; an unexpected open 105/tcp on a modern host should be treated as anomalous and its purpose verified before internet exposure.

IANA assignment

dual-registered — cso ("CCSO name server protocol," assignee Martin Hamilton) AND csnet-ns ("Mailbox Name Nameserver," assignee Marvin Solomon); both on 105/tcp + 105/udp; Reference field blank for all four rows (no RFC cited) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached copy; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)

Range class

well-known (0–1023) [Confirmed]

Registration/Modification date

blank in the registry — no date recorded, not fabricated [Confirmed] — cached IANA CSV

Current status

largely obsolete, superseded by LDAP; a small number of Ph/Qi servers reportedly still reachable as of 2020; exact 2026 prevalence Unknown [Likely] — https://en.wikipedia.org/wiki/CCSO_Nameserver

Related ports

389/636 (LDAP/LDAPS, the modern successor to directory lookup); 43 (whois, another directory-style query service)

Primary use

CCSO Nameserver (Ph/Qi) — early plaintext directory-lookup service (email/phone/department directory), precursor to LDAP; development ~1988, active use from ~1991; architecture documented in RFC 2378 (Sep 1998)

Common software

Qi (server) and Ph (client), the University of Illinois reference implementation; a later Perl/RDB reimplementation "Phd" by Larry Hughes at Indiana University; no other widely documented implementations found

Security implications

no CVE or documented exploit specific to CCSO/Ph/Qi or csnet-ns surfaced in this pass (sourced null — none found, not confirmed-absent); an open 105/tcp on a modern host is unexpected and should be verified before exposure; SANS ISC tracks live scan telemetry for port 105 but volume figures are time-varying and intentionally not hard-coded here

Typically seen on

legacy directory hosts running Ph/Qi; otherwise an anomaly worth investigating

Second registration

csnet-ns ("Mailbox Name Nameserver"), CSNET-era legacy assignment; usage detail Unknown beyond the registry line [Likely] — cached IANA CSV

Analyst note

A responsive port 105 is a legacy CCSO/directory signature; legitimate modern use is rare — verify purpose and treat unexpected exposure as anomalous.

Port 105/udp carries a rare double registration in IANA's Service Name and Transport Protocol Port Number Registry: two distinct, unrelated service names share the number on both TCP and UDP. The first is csnet-ns — "Mailbox Name Nameserver," assignee Marvin Solomon — a name-lookup service for CSNET, the 1980s academic network that bridged universities without ARPANET access before being decommissioned in 1991. The second is cso (also written cso-ns) — "CCSO name server protocol," assignee Martin Hamilton — the client/server directory protocol built at the University of Illinois Urbana-Champaign's Computing and Communications Services Office, whose server component was called Qi and client Ph. CCSO let people look up email addresses, phone numbers, and department affiliations at a university and saw wide campus deployment from roughly 1991 before LDAP and web directories displaced it. RFC 2378 ("The CCSO Nameserver (Ph) Architecture," September 1998) documents the Ph protocol but is described there as connection-based over TCP port 105 — it does not define a UDP transaction format, and IANA cites no RFC in the Reference field for either registration. Neither service is in meaningful use today. For an analyst, 105/udp is essentially a vestigial registry entry: no widely used modern software listens on it, and while ISC's port tracker shows only sporadic low-volume scan traffic (threat level green), contemporary hits almost certainly reflect broad internet-wide sweeps rather than genuine CSNET-NS or CCSO discovery. An unexpected listener on 105 warrants investigation as an anomaly.

IANA assignment (name 1)

csnet-ns — "Mailbox Name Nameserver"; assignee/contact Marvin Solomon; Reference blank (no RFC cited); dual-registered 105/tcp + 105/udp [Confirmed] — IANA Service Names and Port Numbers Registry (cached CSV lines 277–280)

IANA assignment (name 2)

cso (a.k.a. cso-ns) — "CCSO name server protocol"; assignee/contact Martin Hamilton; Reference blank; dual-registered 105/tcp + 105/udp [Confirmed] — IANA registry / iana.org service-names-port-numbers.xhtml

Range class

well-known (0–1023) [Confirmed]

Registration date / modification date

blank in the source registry for all four 105 rows — Unknown, not fabricated [Confirmed-absent] — cached IANA CSV

IANA Reference (RFC)

blank — no RFC cited by IANA. RFC 2378 documents CCSO's Ph protocol but is not the registry reference and specifies TCP operation only [Confirmed] — RFC 2378, IANA registry

Primary use

two obsolete legacy directory/name services — CSNET-NS (CSNET mailbox nameserver) and CCSO Qi/Ph (university people-directory lookups); both superseded (CSNET decommissioned 1991; Ph/Qi displaced by LDAP and web directories)

Common software

legacy UIUC qi server / ph client; only a hobbyist archival revival remains (github.com/michael-lazar/ccso-nameserver, "Resurrecting the Qi/Ph nameserver from '93") — no maintained mainstream software identified

Exposure / scanning

SANS ISC port-105 tracker shows low-volume sporadic scans, threat level green; a historical 2005-12-18 buffer-overflow attempt against tcp/105 is noted. No current large-scale campaigns or port-specific CVEs found this pass

Dual/shared registration

port 105 carries two distinct service names across both transports — an uncommon multi-assignment [Confirmed] — cached IANA CSV

UDP-specific behavior

Unknown — RFC 2378 documents only TCP for Ph; no source found describing an actual UDP wire protocol for either csnet-ns or cso. The udp/105 entry appears to be standard dual-registration rather than an in-use transport [Likely, gap] — RFC 2378

Analyst note

a legacy/obsolete service with no known active mainstream implementation; a listener on 105/tcp or 105/udp is unlikely to serve a current business purpose — treat an unexpected one as worth investigating.