106

Port 106/tcp is one of the clearer cases where the IANA registration and the real-world use diverge. IANA registers 106 (both tcp and udp, a genuine dual registration) as 3com-tsmux, described "3COM-TSMUX," assignee and contact [Jeremy_Siegel], with blank Registration Date, Modification Date, and Reference fields — there is no RFC governing this port, so the IANA Reference stays blank. Notably, IANA's own registry flags the entry with "Known Unauthorized Use on 106," meaning IANA itself documents that the port is squatted in practice. That squatting use is poppassd, the POP Password Change Daemon: a small service (historically run from inetd) implementing a simple FTP-like text protocol — commands USER, PASS, NEWPASS, QUIT with 200/500 response codes — that lets mail users change their POP3/mail-account password remotely, typically wired to PAM on the server side. It never became an IETF standard: Randall Gellens (Qualcomm) drafted a proposed replacement in 2001, citing poppassd's cleartext passwords, excess round-trips, and unauthorized port use as problems, but that Internet-Draft expired in August 2001 without becoming an RFC, and poppassd kept running on 106 unofficially. For an analyst, the practical takeaway is that an open 106/tcp answering with an FTP-like USER/PASS banner is almost certainly poppassd, not 3com-tsmux — and because the base protocol carries the old and new passwords in cleartext with no TLS, the standard guidance (from the daemon's own manpage) is to bind it to loopback only and firewall it off from remote networks. Hosting control panels (e.g. Plesk) historically ran a poppassd-compatible listener on loopback for their web password-change UIs for exactly this reason.

IANA assignment

3com-tsmux — "3COM-TSMUX"; Reference (blank — no RFC cited in IANA registry); assignee/contact [Jeremy_Siegel]; dual-registered 106/tcp + 106/udp (byte-identical rows except transport) [Confirmed] — IANA Service Names and Port Numbers Registry

Registration / Modification date

blank in the IANA registry source — not fabricated [Confirmed] — IANA registry snapshot

IANA anomaly flag

registry marks the entry "Known Unauthorized Use on 106" — IANA itself documents the port is squatted [Confirmed] — IANA registry

Range class

well-known (0–1023)

Prevalence

nmap-services observed open-frequency 106/tcp ≈ 0.005934 — low (roughly 6 in 1,000 sampled hosts), 57th of 6,486 TCP entries; the UDP sibling 106/udp is ≈ 0.000544, an order of magnitude lower. Notably nmap-services labels this row pop3pw, not 3com-tsmux, independently corroborating that the de-facto occupant is poppassd

[Likely] — nmap-services dataset. No internet-wide Shodan/Censys exposure count was verified this pass [Unknown]

Common software

poppassd implementations (e.g. poppassd-ceti on GitHub; historical Debian/Ubuntu poppassd, FreeBSD mail/poppassd); client side Eudora "Change Password" and NUPOP; Plesk-style panels run a loopback poppassd listener

Security implications

poppassd transmits username plus old and new passwords in cleartext (no TLS in base protocol); guidance is to restrict to localhost/loopback via tcpwrappers or firewall and never expose remotely

Primary de-facto use

poppassd (POP Password Change Daemon) — FTP-like text protocol (USER/PASS/NEWPASS/QUIT; 200=success, 500=error) to change a mail account password remotely, backed by PAM [Confirmed] — Debian poppassd(8) manpage; connected.app/ports/106

Standards status

no RFC; Randall Gellens (Qualcomm) 2001 replacement Internet-Draft expired Aug 2001 without becoming an RFC [Confirmed] — connected.app/ports/106

CVE

none located in this pass — Unknown (not asserted absent)

Analyst note

an open 106/tcp with an FTP-like USER/PASS banner should be assumed poppassd, not 3com-tsmux; treat as a cleartext credential-change surface and confirm it is loopback-bound.

Port 106/udp is registered with IANA under the service name 3com-tsmux, description "3COM-TSMUX," assignee and contact Jeremy Siegel, with blank Registration Date, Modification Date, and Reference fields; it is dual-registered on 106/tcp and 106/udp with identical fields. The registry also carries the verbatim annotation "Known Unauthorized Use on 106," meaning IANA itself flags that the real-world deployed use of this port diverges from its registered name. In practice port 106 is overwhelmingly associated not with 3com-tsmux but with poppassd — the POP3 Password Daemon (sometimes "epass"), an unofficial service that lets a mail client (historically Qualcomm Eudora, also NUPOP) change a user's mailbox password without a full shell or Telnet account; implementations shipped with Qpopper. poppassd is documented as a TCP request/response protocol that speaks a simple POP-like text command exchange, so the well-known-port TCP/UDP pairing here reflects standard IANA paired allocation rather than any attested UDP traffic — no source documents an actual UDP poppassd implementation, so UDP-specific behavior is treated as not attested. Two dated security concerns exist for the service: by design poppassd transmits the old and new passwords in cleartext (guidance is to restrict it to localhost and firewall external access), and Qpopper's bundled poppassd (versions 4.0.3–4.0.5, disclosed circa 2007) carried a local privilege-escalation flaw where a user could control the path passed to the -s option and leverage the setuid-root binary to gain root; no CVE identifier was located for that specific advisory. For an analyst, a responsive port 106 today is a legacy, low-prevalence signal — most likely a password-change daemon on a mail host — and given its cleartext design and local-root history, any internet-facing instance warrants scrutiny.

IANA assignment

3com-tsmux — "3COM-TSMUX"; assignee/contact Jeremy Siegel; Registration Date, Modification Date, and Reference all blank; dual-registered 106/tcp + 106/udp with identical fields [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=106)

IANA reference (RFC)

blank — no RFC cited in the registry entry; left blank, not inferred [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed]

Related ports

POP3 110/tcp; the mail-service cluster (25, 110, 143)

Security implications

(1) poppassd transmits old/new passwords in cleartext — guidance is localhost-only + firewall external access; (2) Qpopper poppassd 4.0.3–4.0.5 (disclosed ~2007) local privilege escalation via attacker-controlled -s path on the setuid-root binary → root; no CVE number located, cite as documented local-root writeup, not a confirmed CVE

Exposure/scanning

legacy, low-prevalence port; no current (2024–2026) mass-scan or Shodan-style exposure statistic located for 106/udp or 106/tcp

Typically seen on

legacy mail hosts running a POP password-change daemon; otherwise an anomaly

Registry annotation

literal "Known Unauthorized Use on 106" — IANA flags deployed use diverging from the registered name [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Actual common use

poppassd (POP3 Password Daemon / "epass") — lets a POP mail client (Eudora, NUPOP) change a mailbox password without a shell account; shipped with Qpopper. This is the IANA-flagged unauthorized overlay, not 3com-tsmux [Confirmed] — https://manpages.ubuntu.com/manpages/bionic/man8/poppassd.8.html, https://www.gsp.com/cgi-bin/man.cgi?section=8&topic=poppassd, https://www.speedguide.net/port.php?port=106

UDP vs TCP

poppassd is documented as a TCP text command/response protocol; no source attests an actual UDP poppassd implementation — 106/udp appears to be standard paired allocation, so UDP-specific use is Unknown/not attested [Likely] — https://manpages.ubuntu.com/manpages/bionic/man8/poppassd.8.html

Analyst note

A responsive port 106 is most likely poppassd on a mail host; its cleartext design and local-root history make any internet-facing instance worth investigating.