118
Summary
- // if you see it open
- No port-118-specific CVEs, malware families, or documented scanning campaigns were found in a single light web-research pass (2026-07-02). Absence of findings is reported as an honest null, not evidence of safety. No mainstream database engine uses port 118 (MySQL 3306, MS SQL Server 1433/1434, PostgreSQL 5432, Oracle 1521), so an open 118 warrants investigation as an anomaly.
- // analyst note
- An open port 118 does not map to any confirmed modern service — investigate as an anomaly, decoy, or misconfiguration rather than assuming legitimate database traffic.
About port 118/tcp.
Port 118/tcp is registered with IANA as sqlserv with the description "SQL Services," under an individual assignee, "Larry Barnes," rather than a corporate or vendor name. The registry carries no RFC or other reference for the assignment — the Reference, Registration Date, Modification Date, Service Code, Unauthorized Use Reported, and Assignment Notes columns are all blank in the cached registry snapshot — so no published standard governs this port's behavior. The registration is dual: 118/udp carries the identical service name, description, and assignee, so the number is reserved on both transports. Beyond the bare IANA record, port 118 is functionally dormant. Secondary port-reference sites (tcp-udp-ports.com, whatportis.com) repeat an association with early Sybase SQL Server tooling, but that attribution could not be corroborated against Sybase/SAP's own documentation, which assigns its database and monitor services to other ports (1498, 2638, 4950) — so the Sybase link is unverified folklore, not a sourced fact, and is not adopted here. No mainstream database engine uses 118: MySQL binds 3306, Microsoft SQL Server 1433/1434, PostgreSQL 5432, and Oracle 1521. A single web-research pass found no CVEs, malware families, or documented scanning campaigns specific to this port; that absence is reported as an honest null, not as evidence of safety. For an analyst, an open port 118 is uncommon and, given no legitimate modern service maps to it, warrants investigation rather than an assumption of benign database traffic.
- IANA assignment
sqlserv— "SQL Services"; reference blank (no RFC cited in registry); assignee Larry Barnes; dual-registered 118/tcp + 118/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached snapshot; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)- Range class
- well-known (0–1023) [Confirmed]
- Registration / modification date
- blank in the registry snapshot — not recorded by IANA for this entry [Confirmed] — cached registry CSV (blank stays blank; no date fabricated)
- Related ports
- modern database ports (1433/1434, 1521, 3306, 5432) for contrast; 156/tcp
sqlsrv(SQL Service) as a similarly-named neighbor
Primary use
nominally "SQL Services" (database client-server connectivity) per the registry name; no protocol specification exists
Common software today
none identifiable; modern databases use other ports (MySQL 3306, MS SQL 1433/1434, PostgreSQL 5432, Oracle 1521); 118 appears legacy/dormant
Security implications
no port-118-specific CVEs, malware, or scanning campaigns found in a single light pass; absence reported as a null, not a safety claim; treat any open 118 as an anomaly to investigate [Unknown] — https://netwrix.com/en/resources/blog/open-ports-vulnerability-list/, https://www.tenable.com/tenable-io-dashboards/vulnerabilities-by-common-ports-dashboard
- Sybase attribution
- unverified — repeated on secondary port sites but contradicted by Sybase/SAP docs, which cite ports 1498/2638/4950; not adopted as fact [Unknown] — https://tcp-udp-ports.com/port-118.htm, https://whatportis.com/ports/118_sql-structured-query-language-services, https://infocenter.sybase.com/help/topic/com.sybase.help.sqlanywhere.12.0.1/dbadmin/serverport-network-conparm.html
- Analyst note
- An open port 118 does not map to any confirmed modern service — investigate as an anomaly, decoy, or misconfiguration rather than assuming legitimate database traffic.
About port 118/udp.
Port 118/udp is registered with IANA as sqlserv with the description "SQL Services," assignee Larry Barnes, dual-registered on both TCP and UDP (118/tcp and 118/udp carry the identical name, description, and assignee). The registry row carries no reference, no registration or modification date, no service code, and no assignment notes — every one of those columns is blank in the IANA Service Name and Transport Protocol Port Number Registry snapshot, so there is no RFC or specification tying the assignment to any particular vendor product or protocol. The name predates the ports that now actually carry SQL traffic: Microsoft SQL Server listens on TCP 1433, its browser/resolution service on UDP/TCP 1434, MySQL on TCP 3306, and Oracle on TCP 1521 — none of which relate to port 118. For an analyst, 118 is best understood as a legacy generic-name reservation rather than an active protocol: no current or historical database engine, driver, or vendor product could be verified as actually running a listener on 118/udp. Secondary port-database sites (WhatPortIs, SpeedGuide, AuditMyPC, PortsMaster) merely repeat the bare IANA registration without citing any real-world software. No CVE, malware family, or Shodan/scanning writeup specifically discussing 118/udp exposure was found as of this research date; that is an honest null (UDP scanners sweep the full range regardless), not a proven absence, but no port-118-specific security literature surfaced.
- IANA assignment
sqlserv— "SQL Services"; reference (blank — no RFC cited in IANA registry); assignee Larry Barnes; dual-registered 118/tcp + 118/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached snapshot; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml)- Range class
- well-known (0–1023) [Confirmed]
- Registration / modification date
- blank in the IANA registry row — not recorded [Confirmed] — cached registry CSV (row blank; no date invented)
Primary use
generic name-based "SQL Services" reservation from the early port-assignment era; not tied to a specific vendor product or spec
Other/unofficial uses
none identified — no database engine, driver, or vendor product verified as listening on 118/udp in practice
Security implications
no port-118-specific CVE, malware, or scanning campaign found; treat a responsive 118/udp as anomalous given negligible legitimate deployment
- Contrast
- modern SQL transports (MS SQL 1433, SQL Server Browser 1434, MySQL 3306, Oracle 1521) are unrelated to port 118 [Confirmed] — vendor documentation
- Analyst note
- An open 118/udp is statistically rare and lacks any known active service population — investigate as a legacy reservation echo, decoy, or misconfiguration rather than a normal SQL service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| sqlserv | UDP | SQL Services | 0.08% |
| sqlserv | TCP | SQL Services | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.