11
Summary
- // if you see it open
- Information disclosure / reconnaissance: leaks usernames and session/process info with no authentication or encryption, handing attackers valid account names for password attacks and visibility into running processes. Security baselines and pentest methodologies flag an open port 11 as an information-disclosure issue. Should never be exposed.
- // common applications
- historical only
- // analyst note
- An open systat is a recon goldmine (user enumeration) and indicates a very old/unhardened host; disable immediately.
About port 11/tcp.
Port 11/tcp is registered with IANA as systat with the description "Active Users," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP). The service, Active Users, is defined in RFC 866 (Postel, May 1983): a connection elicits a plaintext list of the users currently logged into the system — historically extended by some implementations to dump the process or user table — after which the connection closes. There is no authentication and no encryption; the data is simply handed to whoever connects. The IANA reference field is blank. That design makes the security implication straightforward and serious for an exposed host: SYSTAT is an information-disclosure and reconnaissance service that leaks usernames and session or process details directly to an attacker, handing them valid account names to target with password attacks and a view into what the system is running. Security baselines and penetration-testing methodologies routinely flag an open port 11 as an information-disclosure finding, and it should never be exposed. Like the other "small services" of its era, SYSTAT was part of the default inetd/r-services posture on old BSD and Unix systems and is essentially never appropriate on a modern internet-facing host. For an analyst, an open systat is effectively a free user-enumeration feed for attackers and a strong indicator of a very old or unhardened system, and it should be disabled immediately.
- IANA assignment
systat— "Active Users"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 11/tcp + 11/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 11/tcp ≈ 0.000075; 11/udp ≈ 0.000577 (de-facto, very rare) [Well-established] — nmap-services file
- Related ports
- 7 (echo), 9 (discard), 13 (daytime), 17 (qotd), 19 (chargen); 79 (finger, similar disclosure)
Primary use
return the list of active users/processes (RFC 866)
Other/unofficial uses
legacy diagnostic/recon utility [Well-established]
Security implications
information disclosure / reconnaissance — leaks usernames and session/process info with no auth; aids password attacks; routinely flagged by security baselines; should never be exposed
Typically seen on
legacy BSD/Unix hosts (r-services era), unhardened systems
- Analyst note
- An open systat is a recon goldmine (user enumeration) and indicates a very old/unhardened host; disable immediately.
About port 11/udp.
Port 11/udp is registered with IANA as systat with the description "Active Users," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP with an identical registry row). The service, Active Users, is defined in RFC 866 (Postel, May 1983): on UDP, the server replies to any received datagram with a plaintext datagram listing the users currently logged into the system — typically username, login time, and originating host — and if that listing exceeds a single datagram it is sent as a sequence of datagrams without splitting an individual user's line across them; the content of the inbound datagram is discarded. There is no authentication and no encryption: the user list is handed to whoever sends a packet. The IANA reference field is blank, and the registry carries no registration or modification date for the entry. That design makes the security implication straightforward and serious for an exposed host: SYSTAT is an information-disclosure and reconnaissance service that leaks valid usernames and session details directly to any host that probes it, handing an attacker account names to target with password attacks and a view of who is on the system. Wikipedia notes that its use is considered a security vulnerability, and legacy-port hardening checklists recommend disabling it on all hosts. No CVE is specifically associated with the port-11 listener, and no malware is known to abuse 11/udp in particular, but an internet-facing systat is an unauthenticated recon vector. Like the other "small services" of its era, SYSTAT was part of the default inetd posture on old BSD and Unix systems; it is obsolete in practice and disabled by default on modern operating systems, so re-enabling it requires deliberately configuring a legacy inetd/xinetd entry. Unlike the UDP "responder" services such as chargen (19), daytime (13), and echo (7), systat is not commonly cited as a high-amplification reflection vector — its reply is bounded by the active-user list rather than an attacker-controlled or padded payload — but as a small-service UDP responder that answers spoofable datagrams it should still be closed. For an analyst, an open 11/udp is effectively a free user-enumeration feed and a strong indicator of a very old or unhardened host, and it should be disabled immediately.
- IANA assignment
systat— "Active Users"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 11/tcp + 11/udp (identical registry row) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 27)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services de-facto open-frequency 11/udp ≈ 0.000577 (very rare) [Likely] — nmap-services dataset (carried from the 11/tcp sibling entry; not independently re-derived this cycle)
- Related ports
- 7 (echo), 9 (discard), 13 (daytime), 17 (qotd), 19 (chargen); 79 (finger, similar disclosure); 11/tcp twin
Primary use
on UDP, reply to a received datagram with the list of active users; multi-datagram listings are not split mid-user (RFC 866)
Other/unofficial uses
legacy diagnostic/recon utility; early ARPANET-era Unix network service with no named modern implementation
Security implications
information disclosure / reconnaissance — returns a plaintext list of logged-in users (username, login time, originating host) to any prober with no authentication; "its use is considered a security vulnerability"; hardening guidance recommends disabling it on all hosts; no CVE specific to the port-11 listener and no known malware targeting 11/udp; not a notable high-amplification reflector (reply bounded by the user list)
Typically seen on
legacy BSD/Unix hosts (inetd small-services era), unhardened systems; disabled by default on modern OSes
- Analyst note
- An open systat is a recon goldmine (user enumeration) and indicates a very old/unhardened host; disable immediately.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| systat | UDP | Active Users | 0.06% |
| systat | TCP | Active Users | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.