125
Summary
- // if you see it open
- No CVEs, malware families, botnets, or service-specific scanning/exploitation campaigns specific to port 125 were found. Port-scanner reference sites list the IANA registration but report no trojan/backdoor association. Unsolicited TCP/125 traffic is most plausibly broad-range internet background scanning (inference; the only measured figure is the nmap-services observed open-frequency, very low at ~0.000176 for 125/tcp).
- // analyst note
- an obscure legacy IANA assignment with no known modern implementation; treat a responsive port 125 as an anomaly and investigate, since no legitimate contemporary service is expected.
About port 125/tcp.
Port 125/tcp is registered with IANA as locus-map with the description "Locus PC-Interface Net Map Ser," assignee Eric Peterson, and a blank reference field. The port is dual-registered — 125/udp carries an identical row (same service name, description, assignee, and contact, with all other fields likewise blank). The assignment is a legacy one: it belongs to Locus Computing Corporation's PC-Interface product, a 1980s–1990s cross-platform integration toolkit that let MS-DOS, early Windows, and Macintosh clients use a Unix host as a shared network file and print server via a proprietary redirector — conceptually the role that NFS and SMB filled later. Port 125 was registered for the "Net Map Server" component of that product. Locus Computing was acquired by Platinum Technology in 1995, and PC-Interface has no current relevance; no modern software, daemon, or widely deployed service was found that binds to TCP/125 under this registration today. The IANA registry lists no per-assignment date for this pre-RFC-6335-era entry, and no RFC reference — both stay blank rather than being invented. For an analyst, port 125 is an obscure well-known-range assignment with no known contemporary implementation, no CVEs, and no documented malware, botnet, or service-specific scanning campaign. Unsolicited traffic to TCP/125 in the wild is most plausibly ordinary broad-range internet background scanning that probes the full well-known port range indiscriminately, rather than anything targeting this specific service — an inference; the one sourced measurement available is the nmap-services observed open-frequency, very low at ≈ 0.000176 for 125/tcp (≈ 0.000478 on the paired 125/udp row).
- IANA assignment
locus-map— "Locus PC-Interface Net Map Ser"; reference (blank — no RFC cited in IANA registry); assignee Eric Peterson; dual-registered 125/tcp + 125/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; local cached registry CSV lines 319–320- Range class
- well-known (0–1023) — IANA System Port range [Confirmed] — IANA port-range classification
- Assignment date
- Unknown — IANA registry carries no per-assignment date for this legacy entry; not fabricated [Unknown]
- Prevalence / modern software
- nmap-services observed open-frequency 125/tcp ≈ 0.000176 — very low (roughly 2 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 125/udp side is higher at ≈ 0.000478 [Confirmed] — nmap-services dataset. No modern daemon or service was found binding TCP/125 under this registration; legacy assignment only [Unknown]
- Related ports
- contrast modern file/print sharing (SMB 445, NFS 2049); other legacy vendor assignments in the well-known range
Primary use
"Net Map Server" component of Locus Computing Corporation's PC-Interface, a cross-platform (DOS/Windows/Mac-to-Unix) file/print redirector, circa 1980s–1990s
Security implications
no CVEs, malware families, botnets, or notable internet-wide scanning/exploitation campaigns specific to port 125 were found; port-scanner reference sites list the IANA registration but report no trojan/backdoor association
Typically seen on
no known contemporary hosts; unsolicited traffic most plausibly broad-range background scan noise (inference; the nmap-services open-frequency above is the only measured figure)
- Reference
- Unknown/blank — no RFC referenced in the IANA registry; left blank per registry [Confirmed] — IANA registry
- Vendor lineage
- Locus Computing Corporation acquired by Platinum Technology in 1995; PC-Interface not in modern use [Likely] — en.wikipedia.org/wiki/Locus_Computing_Corporation
- Analyst note
- an obscure legacy IANA assignment with no known modern implementation; treat a responsive port 125 as an anomaly and investigate, since no legitimate contemporary service is expected.
About port 125/udp.
Port 125/udp is registered with IANA as locus-map with the description "Locus PC-Interface Net Map Ser" (truncated in the registry from "Locus PC-Interface Net Map Server"), assignee and contact [Eric_Peterson], and a blank reference field. The same service name, description, and assignee are dual-registered on 125/tcp, so both transports carry the identical assignment with no RFC citation and no registration or modification date recorded in the registry. The assignment traces to the Locus PC-Interface product family — a legacy DOS/AIX interoperability suite (also distributed by IBM as "AIX Access for DOS Users," AADU, and later PC-Enterprise) that let DOS and early Windows PC clients reach AIX servers for file and print sharing. The "Net Map Server" component (pcimapsvr) is paired in the same product family with port 96 (locus-con, the connection server, pciconsvr). This is a defunct, pre-web assignment: no actively maintained modern protocol uses it, and no current software vendor is documented as deploying it today. Community sources (a comp.unix.aix newsgroup thread) supply the historical AIX-suite context, so that lineage is tagged Likely rather than Confirmed. For an analyst, a responsive 125/udp is obscure — nmap's frequency table lists a very low observed-open frequency (~0.000478), consistent with a dormant legacy port rather than one seeing routine scanning. No CVEs, malware associations, or Shodan/Censys/GreyNoise exposure figures specific to this port were located in this research pass; those remain Unknown rather than invented. The IANA reference field is blank and is reported blank — no RFC was fabricated.
- IANA assignment
locus-map— "Locus PC-Interface Net Map Ser" (registry-truncated form of "Net Map Server"); reference (blank — no RFC cited in IANA registry); assignee/contact [Eric_Peterson]; dual-registered 125/tcp + 125/udp[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local CSV snapshot; iana.org)- Range class
- well-known (0–1023) [Confirmed]
- Registration / modification date
- blank in the IANA registry — none recorded (reported blank, not fabricated) [Confirmed] — IANA registry CSV
- Prevalence
- nmap-services observed open-frequency 125/udp ≈ 0.000478 (very low) [Likely] — nmap-services (nmap 7.70)
- Related ports
- 96/tcp+udp (locus-con, the paired connection server); 125/tcp (identical dual registration)
Primary use
the "Net Map Server" (pcimapsvr) component of the legacy Locus PC-Interface / PC-Enterprise DOS↔AIX interoperability suite (a.k.a. IBM AADU, "AIX Access for DOS Users"); paired with port 96 (locus-con)
Security implications
no CVEs, malware associations, or scanning/exposure statistics (Shodan/Censys/GreyNoise/SANS ISC) specific to this port were found in this pass — Unknown; treat as legacy/dormant rather than an actively exploited service
Common software today
Unknown — no currently-maintained software confirmed; historical association is IBM AIX's PC-Interface / PC-Enterprise stack (pcimapsvr.ip, pciconsvr.ip) from the DOS/AIX era
- Analyst note
- An open 125/udp is statistically rare and historically tied to a defunct DOS/AIX file-sharing suite — treat as a legacy/anomalous signal and investigate context rather than assuming a modern service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| locus-map | UDP | Locus PC-Interface Net Map Ser | 0.05% |
| locus-map | TCP | Locus PC-Interface Net Map Ser | 0.02% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.