111

Port 111/tcp is registered with IANA as sunrpc with the description "SUN Remote Procedure Call," assignee Chuck McManis, and a blank reference field (dual-registered on TCP and UDP). The service is the RPC portmapper, known on modern systems as rpcbind: a registry that maps ONC RPC program numbers to the dynamic TCP/UDP ports their services actually listen on. A client first contacts port 111 to discover where, for example, NFS, mountd, or NIS is running, then connects to that resolved port. The underlying RPC is ONC RPC (RFC 1057, later RFC 5531), and the binding service is specified in RFC 1833; rpcbind is the modern, IPv6-capable successor to the legacy portmap, and rpcinfo -p enumerates the registered services. The IANA reference field is blank. Security-wise, 111 carries real weight on two fronts. First, the UDP portmapper is a reflection/amplification DDoS vector: Level 3 Threat Research Labs flagged portmap-based DRDoS in August 2015 and Akamai's PLXsert issued an advisory on 28 October 2015 measuring amplification commonly around 9.65x and peaking at about 50.53x, with campaigns exceeding 100 Gbps, while US-CERT/CISA TA14-017A lists portmap (rpcbind) at a bandwidth amplification factor of roughly 7 to 28 via a malformed request. Second, an exposed portmapper is an enumeration foothold (rpcinfo reveals running RPC services, often leading an attacker straight to NFS), and CVE-2017-8779 ("rpcbomb," 3 May 2017) lets a crafted UDP packet to port 111 exhaust rpcbind/libtirpc memory for a remote denial of service. For an analyst, an open 111 means a Unix/Linux host running RPC services such as NFS — both an enumeration and an amplification/DoS liability — and it should not be internet-exposed.

IANA assignment

sunrpc — "SUN Remote Procedure Call"; reference (blank — no RFC cited in IANA registry); assignee Chuck McManis; dual-registered 111/tcp + 111/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

among the more commonly open Unix/Linux ports; nmap labels it rpcbind (de-facto) [Well-established] — nmap-services file

Related ports

2049 (NFS); dynamic mountd/statd/nlockmgr/NIS ports resolved via 111

Primary use

RPC portmapper / rpcbind — maps RPC program numbers to dynamic ports

Other/unofficial uses

gateway to NFS/mountd/NIS discovery [Well-established]

Security implications

portmap/rpcbind UDP reflection DDoS (Level 3 Aug 2015; Akamai Oct 2015, ~9.65x typical / ~50.53x peak, 100+ Gbps; TA14-017A BAF ~7–28); rpcinfo enumeration → NFS; CVE-2017-8779 "rpcbomb" remote DoS

Typically seen on

Unix/Linux/NFS servers

Analyst note

An open 111 means a Unix/Linux host running RPC services (often NFS) — an enumeration foothold and a UDP amplification/DoS liability. Should not be internet-exposed.

Port 111/udp is registered with IANA as sunrpc ("SUN Remote Procedure Call"), with both assignee and contact listed as Chuck McManis and a blank reference field; it is dual-registered identically on TCP and UDP. In practice the service is almost always called the portmapper (later rpcbind), the fixed rendezvous point for Sun's ONC RPC framework. Because individual RPC programs bind to arbitrary high ports at startup, a client must first ask the portmapper "what port is program X listening on?" — and the portmapper itself therefore needs a fixed, well-known address, which is why port 111 is hard-coded and cannot be dynamically assigned. The protocol is specified in RFC 1833 ("Binding Protocols for ONC RPC Version 2," August 1995): version 2 is the TCP/UDP-specific portmapper, while versions 3 and 4 are the transport-independent rpcbind; both use port 111 over TCP and UDP. The service originated in SunOS 2.0 and survives today as the rpcbind daemon shipped by default on most Linux distributions and BSDs. Its principal consumers are NFS (v2/v3 depend on it; v4 can bypass it), NIS/YP, and the NFS helper daemons rpc.mountd, rpc.statd, and rpc.lockd. For an analyst, port 111 is a high-value reconnaissance target: an unauthenticated query (the equivalent of rpcinfo -p) returns the full inventory of RPC programs, their versions, and the dynamic ports they occupy — effectively a map of the host's NFS exports and RPC services. UDP 111 is also a confirmed DDoS amplification/DRDoS vector (documented in 2015) and the entry point for CVE-2017-8779 ("rpcbomb"), an unbounded-memory-allocation flaw reachable by crafted UDP packets. Internet exposure of port 111 is broadly treated as a misconfiguration; the standard guidance is to block TCP/UDP 111 at the perimeter.

IANA assignment

sunrpc — "SUN Remote Procedure Call"; reference (blank — no RFC cited in IANA registry); assignee and contact both Chuck McManis; dual-registered 111/tcp + 111/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 292; tcp on line 291)

Range class

well-known (0–1023)

Prevalence

nmap-services observed open-frequency 111/udp ≈ 0.093988 — moderate, and one of the highest-ranked UDP entries in the dataset (21st of 5,615): found open on roughly 9 in 100 sampled hosts. The TCP sibling is lower at ≈ 0.030034 (~3 in 100), so rpcbind is seen more often on UDP than on TCP

[Likely] — nmap-services dataset

Related ports

NFS 2049 (tcp/udp); the RPC helper daemons mountd/statd/lockd on dynamic ports discovered via 111; the /port/ hub

Primary use

ONC RPC portmapper / rpcbind — the fixed-address binding service clients query to discover which dynamic port a given RPC program is using; port 111 is hard-coded because the portmapper cannot itself be dynamically located

Protocol spec

RFC 1833, "Binding Protocols for ONC RPC Version 2," August 1995 (v2 = portmapper, TCP/UDP-specific; v3/v4 = rpcbind, transport-independent). Note: the IANA registry reference column is blank; RFC 1833 is the normative spec found via the protocol literature, not an IANA-cited reference

Common software / consumers

rpcbind (successor to the original portmap daemon; default on most Linux/BSD); primary consumers NFS v2/v3 (v4 can bypass), NIS/YP, rpc.mountd, rpc.statd, rpc.lockd; portmapper originated in SunOS 2.0

Security implications

unauthenticated service enumeration (rpcinfo -p lists all RPC programs, versions, and dynamic ports → maps NFS exports/RPC services); confirmed UDP amplification/DRDoS vector (2015); CVE-2017-8779 "rpcbomb" — crafted UDP packets to port 111 trigger unbounded allocation in xdr_bytes()/xdr_string() (rpcbind ≤0.2.4, libtirpc ≤1.0.1 and 1.0.2-rc3, ntirpc ≤1.4.3), up to ~4 GB consumed per request leading to OOM kill (CVSS 7.5); CVE-1999-0632 covers portmapper exposure itself as a low-severity finding; NFS-targeting kill chains have used open port 111 to enumerate and mount shares [Confirmed/Threat-reported] — CVE-2017-8779 (cvedetails), Red Hat solution 3025811, HackerOne #791893, pentestpad port-111 writeup, Wikipedia (Portmap)

Typically seen on

Unix/Linux hosts running NFS, NIS, or other ONC RPC services; internet-facing exposure is generally a misconfiguration

Analyst note

A reachable port 111 should prompt an rpcinfo enumeration to inventory exposed RPC services (especially NFS); on the public internet it is a recon foothold and an amplification/CVE risk — recommend perimeter blocking.