117
Summary
- // if you see it open
- Unknown / generic reasoning only. As a legacy, effectively unused service, an open 117/tcp on a modern host is atypical and usually indicates a legacy Unix system, a stale/misconfigured firewall rule, or a non-standard service bound opportunistically to the port. No port-117-specific threat-intel, Shodan, or honeypot statistics were verified in this pass; the only measured figure is the nmap-services open-frequency recorded under prevalence.
- // analyst note
- A responsive port 117 is statistically uncommon today — treat as a legacy or anomalous signal and investigate in context; legitimate modern use is unlikely.
About port 117/tcp.
Port 117/tcp is registered with IANA under the service name uucp-path, description "UUCP Path Service," dual-registered on both TCP and UDP; the assignee, contact, registration date, and Reference columns are all blank in the registry, so no IANA-cited RFC is attached to this assignment. The service maps to the historical UUCP (Unix-to-Unix Copy) world: a client would query the path server to learn the store-and-forward mail route to a distant host — the bang-path (hostA!hostB!user) needed to relay mail across UUCP, CSNET, or BITNET links before ubiquitous TCP/IP and SMTP made direct delivery the norm. Secondary sources (EventTracker's port knowledge base, t1shopper) associate the service with RFC 915, "Network Mail Path Service" (M.A. Elvy and R. Nedved, December 1984), but that RFC is not shown in the live IANA Reference column, so it is recorded here as a historical protocol association rather than an IANA-cited reference. The protocol is obsolete: UUCP path lookups were meaningful chiefly from the 1970s into the mid-1990s, and no current, actively maintained daemon binding to port 117 was verified in this pass. For an analyst, an open 117/tcp on a modern host is unusual — most likely a legacy Unix system, a stale firewall rule, or a non-standard service an operator or scanner has bound opportunistically to the port. The nmap-services dataset does carry a measured open-frequency for this port — 117/tcp at approximately 0.000013, the dataset's lowest nonzero step — but no port-117-specific Shodan or honeypot statistics surfaced during research, so no claim is made about abuse volume beyond that one measured figure. Legitimate production use today is not in evidence, so a responsive port 117 is best treated as a legacy or anomalous signal worth investigating in context rather than a routine service.
- IANA assignment
uucp-path— "UUCP Path Service"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 117/tcp + 117/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cached CSV; iana.org registry)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence / exposure
- nmap-services observed open-frequency 117/tcp ≈ 0.000013 — the dataset's lowest nonzero step [Confirmed] — nmap-services dataset; sibling 117/udp ≈ 0.000527, some forty times higher. No port-117-specific Shodan or honeypot statistics found in this pass [Unknown]
- Related ports
- the UUCP cluster (540/tcp uucp, 4031/tcp uucp-rlogin) and legacy store-and-forward mail services
Primary use
UUCP mail-routing path lookup — query the store-and-forward path (bang-path) to reach a host over UUCP/CSNET/BITNET before direct SMTP delivery
Common software
Unknown — no current, actively maintained port-117 daemon verified; the associated technology family is historical UUCP (e.g. Taylor UUCP) [Unknown]
Security implications
Unknown (generic reasoning only) — an open 117/tcp on a modern host is atypical and usually points to a legacy Unix host, a stale firewall rule, or an opportunistically bound non-standard service; no port-117-specific threat source verified [Unknown]
Typically seen on
legacy Unix/UUCP-era systems; otherwise an anomaly worth investigating
- Historical protocol reference
- RFC 915, "Network Mail Path Service" (Elvy & Nedved, Dec 1984) — associated by secondary sources, NOT present in the live IANA Reference column [Likely] — rfc-editor.org/rfc/rfc915.html; kb.eventtracker.com
- Current relevance
- obsolete/historical; relevant chiefly 1970s–mid-1990s before SMTP became the norm; no evidence of meaningful legitimate production use today [Likely] — RFC 915
- Analyst note
- A responsive port 117 is statistically uncommon today — treat as a legacy or anomalous signal and investigate in context; legitimate modern use is unlikely.
About port 117/udp.
Port 117/udp is registered with IANA as uucp-path with the description "UUCP Path Service." In the cached IANA service-names CSV the row for 117/udp lists only the service name and description — the Assignee, Contact, Registration Date, Modification Date, and Reference columns are all blank, so no assignee, no date, and no RFC citation are recorded in the registry itself. The service is dual-registered: 117/tcp and 117/udp carry the identical name and description in adjacent registry rows. The functional origin of this port is RFC 915, "Network Mail Path Service" (M.A. Elvy and R. Nedved, December 1984), which specifies a lookup service that let a client query a server for the UUCP/BITNET/CSNET relay path needed to reach a mailbox not directly on the ARPA-Internet — a routing aid for the store-and-forward mail world of the 1980s. The command set is minimal: HELP, PATH, and QUIT. Importantly, RFC 915 defines the service as connection-based over TCP ("a server listens for TCP connections on the assigned port of 117"); it never describes a UDP variant. The UDP/117 entry appears to follow the common IANA practice of mirroring a TCP service name onto the UDP port table without an independent UDP protocol specification, so RFC 915 should be treated as documenting the TCP side only, not as confirming any UDP behavior. For an analyst, the practical significance is that this is a mid-1980s legacy protocol tied to UUCP mail networks that were largely retired by the early-to-mid 1990s. No specific server or client software binding UDP/117 was identified, and no CVE, malware, or backdoor associated with port 117 was found. A responsive UDP/117 today is therefore unlikely to be legitimate service traffic and is more plausibly background scanning noise; that inference is not backed by scan telemetry and stays unconfirmed.
- IANA assignment
uucp-path— "UUCP Path Service"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 117/tcp + 117/udp [Confirmed] — cached IANA Service Name and Transport Protocol Port Number Registry CSV (rows for 117/tcp + 117/udp, identical name/description)- Range class
- well-known (0–1023) [Confirmed]
- Related ports
- 117/tcp (identical registration); the UUCP-era small/mail services cluster
Primary use
legacy UUCP/mail path-lookup service defined in RFC 915 (Dec 1984); client queries a server for the relay path to a mailbox; commands HELP / PATH / QUIT [Likely] — RFC 915. Note: RFC 915 specifies the service over TCP only and does not document a UDP variant, so this describes the TCP-side origin of the shared name.
Common software
none identified — the service predates modern package ecosystems and UUCP mail was retired by the mid-1990s; no mainstream software is known to bind UDP/117 for a distinct purpose [Unknown]
Security implications
no CVE, malware, or backdoor associated with port 117 (TCP or UDP) found this pass; a responsive UDP/117 is plausibly scanning noise rather than legitimate traffic, but this is not sourced to scan telemetry [Unknown]
Typically seen on
legacy/obsolete context; no current legitimate deployment identified
- Reference/RFC
- blank in the IANA registry cell (this pass could not isolate the live registry's Reference column for row 117); RFC 915 is an independently verified primary-source match for the service/port pairing but documents TCP behavior [Likely] — RFC 915; IANA registry Reference cell not confirmed this pass
- Analyst note
- Legacy 1980s UUCP-mail lookup service; effectively obsolete. Treat an open UDP/117 as an anomaly worth investigating rather than expected service traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| uucp-path | UDP | UUCP Path Service | 0.05% |
| uucp-path | TCP | UUCP Path Service | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.