112
Summary
- // if you see it open
- Unknown — no CVEs, published Shodan exposure counts, or dated scanning/abuse reports specific to TCP/UDP port 112 (mcidas) were located in this pass. General port-hygiene guidance (firewall unused legacy service ports) applies but is not McIDAS-specific sourced advice.
- // analyst note
- A responsive port 112 most plausibly indicates a McIDAS meteorological data node; treat mismatched context as worth investigating, and never read it as VRRP traffic (that is an IP-protocol-number 112 phenomenon, a different namespace).
About port 112.
Port 112/tcp is registered with IANA as mcidas with the description "McIDAS Data Transmission Protocol," assignee and contact Glenn Davis, and a blank reference field; the assignment is dual-registered identically on both 112/tcp and 112/udp, with every optional registry column (Registration Date, Modification Date, Reference, Service Code, Unauthorized Use Reported, Assignment Notes) left blank. McIDAS is the Man-computer Interactive Data Access System, a meteorological and Earth-science data visualization and analysis package originally developed at the University of Wisconsin–Madison Space Science and Engineering Center (SSEC); the port 112 data-transmission protocol is used to move satellite imagery, radar data, and numerical weather model output between McIDAS workstations and servers. It is a niche academic and meteorological service rather than general-purpose infrastructure — the commonly documented software using it is UW-Madison's McIDAS-X / McIDAS-V, and no mainstream competing application is recorded on this port. An important disambiguation for an analyst: TCP/UDP port 112 (the transport-layer service-name registry) must not be conflated with IP protocol number 112, a separate IANA registry (protocol-numbers) assigned to VRRP, the Virtual Router Redundancy Protocol referenced by RFC 9568 and common on LANs for router failover (historically conflicting with CARP's use of the same protocol number). Those are different namespaces that merely share the numeral 112; only the mcidas assignment belongs to a 112/tcp port entry. No CVEs, published Shodan exposure counts, or dated scanning/abuse datasets specific to TCP/UDP 112 (mcidas) were located in this pass, so exposure and security posture are reported as Unknown rather than invented — general port-hygiene guidance (firewall unused legacy service ports) applies but is not McIDAS-specific sourced advice.
- IANA assignment
mcidas— "McIDAS Data Transmission Protocol"; reference (blank — no RFC cited in IANA registry); assignee/contact Glenn Davis; dual-registered 112/tcp + 112/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry-294; iana.org service-names-port-numbers)- Range class
- well-known (0–1023) [Confirmed]
- Dual registration
- TCP and UDP rows for port 112 are identical in service name, description, assignee, and contact; both leave Registration Date, Modification Date, Reference, Service Code, Unauthorized Use Reported, and Assignment Notes blank[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-294
Primary use
data-transmission protocol for McIDAS (Man-computer Interactive Data Access System), moving satellite imagery, radar, and numerical weather model output between McIDAS workstations/servers
Security implications / exposure
Unknown — no CVEs, Shodan exposure counts, or dated scanning/abuse reports specific to TCP/UDP 112 (mcidas) found in this pass; a low-traffic niche academic service. Do not assert exposure or attack-frequency without a dated, sourced dataset [Unknown]
- Software commonly using it
- UW-Madison SSEC McIDAS-X / McIDAS-V; no other mainstream software documented on port 112 [Likely] — portsmaster.net/port-112
- Disambiguation
- IP protocol number 112 (a different IANA registry, protocol-numbers) is VRRP (RFC 9568), not this port; do not merge — the mcidas port and VRRP protocol number only share the numeral 112 [Confirmed] — iana.org protocol-numbers, Wikipedia VRRP
- Related registry note
- contrast with IP protocol 112 (VRRP) in the protocol-numbers registry
- Analyst note
- A responsive port 112 most plausibly indicates a McIDAS meteorological data node; treat mismatched context as worth investigating, and never read it as VRRP traffic (that is an IP-protocol-number 112 phenomenon, a different namespace).
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| mcidas | UDP | McIDAS Data Transmission Protocol | 0.22% |
| mcidas | TCP | McIDAS Data Transmission Protocol | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.