115

Port 115/tcp is registered with IANA as sftp with the description "Simple File Transfer Protocol," assignee Mark Lottor, and a blank reference field (dual-registered on TCP and UDP). The single most important thing to know about this port is a disambiguation: this sftp is the old Simple File Transfer Protocol defined in RFC 913 (September 1984, Mark K. Lottor), and it is emphatically not the SSH File Transfer Protocol that almost everyone means today by "SFTP." RFC 913 describes a protocol pitched between TFTP and FTP in complexity — more capable than TFTP but simpler than FTP — using a single TCP connection on port 115 with short ASCII commands (USER, PASS, LIST, RETR, STOR, TYPE, DONE) and simple +/-/! response codes. The IANA reference field is blank, and the IETF classifies the protocol as Historic; it was never widely adopted. The modern SFTP, by contrast, is the SSH File Transfer Protocol subsystem that runs encrypted inside an SSH session on port 22 and has no relationship to RFC 913 whatsoever (it does not even have a formal RFC). Because RFC 913 SFTP is unencrypted, obsolete, and essentially never seen in the wild, the security relevance of port 115 is the confusion itself rather than any active threat. For an analyst, an open 115 is almost certainly a curiosity or a mislabel, and the key is not to confuse it with SSH SFTP on port 22.

IANA assignment

sftp — "Simple File Transfer Protocol"; reference (blank — no RFC cited in IANA registry); assignee Mark Lottor; dual-registered 115/tcp + 115/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

effectively absent from modern systems (de-facto) [Well-established] — nmap-services file

Related ports

21 (FTP control), 20 (FTP data), 22 (SSH / SSH-SFTP), 69 (TFTP), 990/989 (FTPS)

Primary use

simple authenticated file transfer (RFC 913); historic/obsolete

Other/unofficial uses

none today; frequently confused with SSH SFTP (port 22) [Well-established]

Security implications

unencrypted and obsolete; the main note is disambiguation — RFC 913 SFTP ≠ SSH SFTP (port 22) [Well-established]

Typically seen on

effectively obsolete; not present on modern systems

Analyst note

If you see 115 open, it is almost certainly a curiosity or a mislabel; do not confuse it with SSH SFTP (port 22). Treat RFC 913 SFTP as historic.

Port 115/udp is registered with IANA as sftp with the description "Simple File Transfer Protocol," assignee Mark Lottor, and a blank reference field. It is dual-registered on both TCP and UDP: 115/tcp carries the identical service name, description, and assignee, with the same consistently blank Registration Date, Modification Date, and Reference columns in the IANA table. The protocol behind this name is the 1984 Simple File Transfer Protocol defined in RFC 913 (M. Lottor, MIT, September 1984) — a small, simple file-transfer protocol intended to sit in complexity between the full File Transfer Protocol (FTP) and the trivial TFTP, supporting user login, directory listing, and get/put/delete operations. It is important not to confuse this with the modern SSH File Transfer Protocol, which shares the "SFTP" abbreviation but is an entirely different protocol that runs over SSH on TCP port 22 and has no dedicated IANA port of its own. RFC 913 explicitly specifies SFTP over a reliable TCP byte stream — the client opens a TCP connection to the remote host's SFTP port (115 decimal) — so the UDP/115 registration appears to be the conventional mirrored well-known-port entry rather than a documented UDP-based exchange; there is no RFC-913 UDP protocol specification. For an analyst, RFC-913 SFTP is effectively obsolete: it defines no encryption, transmitting credentials and file contents in plaintext, and has been superseded in practice by SSH-based SFTP (port 22), FTPS, and other authenticated/encrypted transfer protocols. No CVEs or active-exploitation reporting specific to port 115 were identified, and no current, actively maintained software implementing RFC 913 was found; a responsive 115/udp today is far more likely to be an anomaly, a mislabeled service, or a scan artifact than a legitimate SFTP endpoint. The IANA reference field is blank — RFC 913 is the protocol's actual defining document, but the registry itself cites no RFC for this row, so the registry reference stays blank while the RFC is noted in prose.

IANA assignment

sftp — "Simple File Transfer Protocol"; reference (blank — no RFC cited in IANA registry); assignee Mark Lottor; dual-registered 115/tcp + 115/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 300; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=115)

Range class

well-known (0–1023) [Confirmed]

Registration / modification dates

Unknown (blank in the IANA registry for both the TCP and UDP rows — recorded as a genuine registry gap, not fabricated) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry lines 299–300

Related ports

20/21 (FTP), 22 (SSH / modern SFTP), 69 (TFTP), 990 (FTPS)

Primary use

legacy Simple File Transfer Protocol (RFC 913, M. Lottor, Sept 1984); RFC 913 specifies SFTP over TCP, so the UDP registration is the mirrored well-known-port entry with no documented UDP exchange

Security implications

RFC 913 defines no encryption — credentials and file contents transit in plaintext; superseded by SSH-based SFTP (22), FTPS, and other encrypted transfers; no CVE or advisory specific to port 115 found

Common software

Unknown — no current, actively maintained RFC 913 client or server implementation identified in this pass [Unknown]

Exposure / scanning telemetry

Unknown — no dated, sourced Shodan/Censys/honeypot measurement specific to 115/udp found in this pass [Unknown]

Typically seen on

legacy/obsolete deployments; otherwise an anomaly, mislabeled service, or scan artifact

Dual TCP/UDP registration

115/tcp also registered as sftp / "Simple File Transfer Protocol" / assignee Mark Lottor, with the same blank Registration Date, Modification Date, and Reference fields [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 299

Naming disambiguation

RFC-913 "SFTP" (1984, TCP, plaintext, obsolete) is unrelated to the modern SSH File Transfer Protocol, which shares the abbreviation but runs over SSH on TCP 22 and has no dedicated IANA port [Confirmed] — https://www.rfc-editor.org/rfc/rfc913.html

Analyst note

A responsive 115/udp is statistically rare; treat RFC-913 SFTP as obsolete plaintext and investigate an open port 115 rather than assuming a legitimate service.