113
Summary
- // if you see it open
- Information disclosure (can leak usernames/account info) and inherently untrustworthy — the answer is self-reported by the remote host and may be fabricated; RFC 1413 says it must not be used for access control. Operationally, silently dropping (vs rejecting) port 113 causes SMTP/IRC connection delays via TCP timeout; reject with a TCP RST instead. Deprecated.
- // analyst note
- An open 113 usually means a legacy ident daemon — typically benign but information-leaking; configure it to reject (not drop) to avoid mail/IRC delays.
About port 113/tcp.
Port 113/tcp is registered with IANA under two service-name rows: ident (with a blank description) and auth ("Authentication Service," assignee Mike St. Johns); both have a blank reference field, and only auth is dual-registered on UDP. Notably, neither registry row cites RFC 1413 — a common assumption that does not hold — though RFC 1413 (the Identification Protocol, February 1993) remains the correct protocol specification; it renamed and obsoleted the earlier Authentication Server Protocol lineage of RFC 931/912/816. The protocol lets a server ask the connecting client's host which user owns a given TCP connection: the client connects to port 113 and sends a pair of port numbers, and the server replies with a USERID line naming the operating system and an identifier, or an error such as NO-USER or HIDDEN-USER. The IANA reference field is blank. Security-wise, ident is both information-disclosing (it can leak usernames and account information) and inherently untrustworthy, since the answer is self-reported by the remote host and can simply be fabricated — RFC 1413 itself warns the response is only as trustworthy as the host returning it and must not be used for access control. There is also a well-known operational wrinkle: when port 113 is silently dropped rather than rejected, mail servers and IRC servers that probe it wait for a TCP timeout, slowing connection setup, so the correct configuration is to reject with a TCP RST rather than drop (FortiGate and other firewalls do this by default). Historically IRC servers, some MTAs, and old FTP servers performed ident lookups; the protocol is largely deprecated today. For an analyst, an open 113 usually means a legacy ident daemon — typically benign but information-leaking — and the more practical concern is ensuring it is rejected rather than dropped to avoid mail and IRC delays.
- IANA assignment
- two rows —
ident(description blank) andauth("Authentication Service", assignee Mike St. Johns); reference (blank — RFC 1413 is NOT cited in the registry);authdual-registered 113/tcp + 113/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry - Range class
- well-known (0–1023)
- Prevalence
- nmap names it
ident; commonly seen closed, rarely open today (de-facto) [Well-established] — nmap-services file - Related ports
- 6667 (IRC), 25 (SMTP), 21 (FTP)
Primary use
identify the user owning a TCP connection (RFC 1413)
Other/unofficial uses
IRC-server ident lookups; some MTA/FTP checks [Well-established]
Security implications
information disclosure (usernames/accounts); self-reported and untrustworthy (no access-control use); drop-vs-reject on 113 causes SMTP/IRC connection delays (reject with RST); deprecated
Typically seen on
legacy Unix hosts; machines connecting to IRC networks
- Analyst note
- An open 113 usually means a legacy ident daemon — typically benign but information-leaking; configure it to reject (not drop) to avoid mail/IRC delays.
About port 113/udp.
Port 113/udp is registered with IANA as auth with the description "Authentication Service," assignee and contact both listed as [Mike_St_Johns], and a blank reference field — the same service name auth is dual-registered on 113/tcp and 113/udp with identical description/assignee/contact rows, though the separate ident entry appears only on 113/tcp. The service that made port 113 well-known is the Identification Protocol ("Ident"), defined in RFC 1413 (M. St. Johns, February 1993): a server that receives an incoming connection can query the connecting client's host on port 113, supply the pair of TCP port numbers for that connection, and receive back the local username (or an opaque token) that owns the client end. Historically IRC servers and some mail transfer agents used this to attach a user identity to a connection. The crucial caveat for an analyst is that RFC 1413 specifies Ident as "a connection based application on TCP" — it defines TCP port 113 only and describes no UDP variant. The 113/udp registry row shares the auth service name but has no protocol specification of its own; there is no RFC to cite for the UDP assignment, so the IANA reference field is left blank (do not attribute RFC 1413 to the UDP row). In practice, UDP traffic to port 113 is not standard Ident traffic. Ident responses are unauthenticated and trivially spoofed, so the service is treated as legacy and low-value to expose; a probe of port 113 is generally reconnaissance — checking whether an ident responder exists and what process-ownership it might reveal — rather than a direct high-severity exploit. SANS ISC historically associates port 113 with several trojans/backdoors (e.g., "Invisible Identd Daemon," Kazimas, BackDoor-AUZ), which is why background scan traffic touches it.
- IANA assignment
auth— "Authentication Service"; reference (blank — no RFC cited in IANA registry for the udp row); assignee[Mike_St_Johns], contact[Mike_St_Johns]; dual-registered 113/tcp + 113/udp (the separateidentname is 113/tcp only) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cache the IANA Service Name and Transport Protocol Port Number Registry; iana.org registry)- Range class
- well-known (0–1023) [Confirmed]
- Registration/modification dates
- Unknown — blank in the cached IANA registry CSV; not invented [Confirmed (as blank)] — the IANA Service Name and Transport Protocol Port Number Registry
- Related ports
- 113/tcp (the actual Ident transport); IRC/mail ports whose servers historically issued Ident queries
Primary use
Identification Protocol ("Ident") — a server queries the connecting client's host on port 113 with the connection's TCP port pair to learn the local username owning that connection
Common software
identd / oidentd / pidentd and similar ident daemons on Unix-like systems; historically queried by IRC servers and some MTAs [Likely — consistently named across secondary sources, none IANA/RFC-official] — en.wikipedia.org/wiki/Ident_protocol, verylazytech.com/network-pentesting/ident-port-113
Security implications
Ident responses are unauthenticated and easily spoofed; the service is legacy and low-value to expose. Port 113 shows up in internet background-scan traffic and is historically tracked by SANS ISC as associated with several trojans/backdoors (Invisible Identd Daemon, Kazimas, BackDoor-AUZ, and others). A probe is generally reconnaissance rather than a direct high-severity exploit. Recent (2026) SANS ISC scan-volume figures were not populated on the fetched page — Unknown
Typically seen on
legacy Unix hosts running an ident daemon (predominantly a TCP behavior); UDP/113 traffic is not standard Ident and is more likely scan noise or an anomaly
- Transport caveat
- RFC 1413 defines Ident as "a connection based application on TCP" — TCP port 113 only; NO UDP variant is specified. The 113/udp row shares the
authname but has no protocol spec of its own, so its IANA reference stays blank (not RFC 1413) [Confirmed] — RFC 1413; IANA registry - Analyst note
- Treat 113/udp cautiously — the well-known Ident protocol is TCP-only (RFC 1413). Standard-looking "Ident" activity belongs on 113/tcp; UDP/113 is not defined by the RFC and is usually scan noise rather than a functioning service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ident | TCP | auth | 1.24% |
| auth | UDP | ident, tap, Authentication Service | 0.30% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.