127
Summary
- // if you see it open
- No CVEs, malware families, or Trojan-port associations specific to TCP/UDP 127 were found in this pass, and the port does not appear on common commonly-attacked/malware-associated port lists. Scan-observed openness is very low (nmap-services ~0.000113 on tcp, ~0.000412 on udp). Any open 127/tcp today is more likely unrelated private use than genuine Locus PC-Interface traffic, since the vendor and product are defunct.
- // analyst note
- A responsive port 127 is not a normal modern service; investigate as an anomaly or non-standard/private use rather than genuine Locus traffic.
About port 127/tcp.
Port 127/tcp is registered with IANA as locus-con with the description "Locus PC-Interface Conn Server," assignee and contact Eric Peterson, and a blank reference field; it is dual-registered on TCP and UDP with an identical service name and description. The registration dates from a product line of Locus Computing Corporation, a company founded in 1982 (by Gerald J. Popek, Charles S. Kline, and Gregory I. Thiel) to commercialize the LOCUS distributed operating system developed at UCLA. locus-con was part of Locus's "PC-Interface" toolkit — a 1980s/1990s product that let DOS, Windows, Macintosh, and Unix machines interoperate over a network with Unix serving as the underlying file server. It pairs with the related locus-map service on port 125 (the PC-Interface Net Map Server). This is a legacy, vendor-specific protocol, not an IETF-standardized one, and the IANA registry lists no RFC or reference for it. Locus Computing Corporation was acquired by Platinum Technology Inc. on August 17, 1995, and its distributed-computing lineage later fed the open-source OpenSSI project; the original vendor and product are defunct. For an analyst, port 127 matters mainly as a name in the well-known range with essentially no live legitimate footprint today: no maintained software was identified that implements or listens on locus-con, so a responsive 127/tcp in a modern scan is far more likely a non-standard or private use by unrelated software than genuine Locus PC-Interface traffic. No CVEs, malware families, or Trojan-port associations specific to TCP/UDP 127 were found in this pass, so treat the security association as Unknown rather than assume one; prevalence is measurable, though, and it is tiny — the nmap-services dataset records an observed open-frequency of about 0.000113 for 127/tcp, roughly 1 in 10,000 scanned hosts, with the UDP side somewhat higher at about 0.000412. That figure measures how often the port number was found open, not confirmed Locus PC-Interface traffic, and at that magnitude it corroborates rather than contradicts the reading that the service is effectively dead.
- IANA assignment
locus-con— "Locus PC-Interface Conn Server"; reference (blank — no RFC cited in IANA registry); assignee/contact Eric Peterson; dual-registered 127/tcp + 127/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (also mirrored in the repo's this site's own tooling build artifact)- Range class
- well-known / "system" (0–1023) [Confirmed] — IANA registry range field
- Registration/modification date
- Unknown — IANA publishes no registration or modification date for this legacy system-range entry; left null (this is an IANA port assignment, not an RIR/ASN allocation, so no first-party RDAP date applies) [Confirmed] — IANA registry (blank date columns)
- Prevalence
- nmap-services observed open-frequency 127/tcp ≈ 0.000113 (very low — roughly 1 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 127/udp side is somewhat more common at ≈ 0.000412 [Confirmed] — nmap-services dataset. The figure records scan-observed openness on the port number, not confirmed Locus PC-Interface use. Internet-wide exposure counts from Shodan/Censys specifically were not located this pass [Unknown]
- Related ports
- 125 (locus-map — PC-Interface Net Map Server), the paired Locus PC-Interface service
Primary use
Locus PC-Interface Connection Server — a legacy vendor networking service from Locus Computing Corporation's PC-Interface product, letting DOS/Windows/Mac/Unix systems interoperate with Unix as file server; paired with locus-map on port 125
Common software today
None identified — no actively maintained software implements or listens on locus-con; vendor and product are defunct, so a live 127/tcp is more likely unrelated private use
Security implications
No CVEs, malware families, or Trojan-port entries specific to 127/tcp+udp were found; does not appear on common "commonly attacked/malware-associated ports" lists
- Vendor history
- Locus Computing Corporation founded 1982 to commercialize the UCLA LOCUS distributed OS; acquired by Platinum Technology Inc. on 1995-08-17; defunct, lineage feeds OpenSSI [Confirmed] — Wikipedia (Locus Computing Corporation)
- Aggregator pages
- auditmypc.com and speedguide.net both carry a port-127 reference page consistent with the locus-con naming, but auditmypc was not independently fetched and speedguide returned HTTP 403 this pass — secondary/unverified only [Unknown] — auditmypc.com, speedguide.net (not confirmed)
- Analyst note
- A responsive port 127 is not a normal modern service; investigate as an anomaly or non-standard/private use rather than genuine Locus traffic.
About port 127/udp.
Port 127/udp is registered with IANA as locus-con with the description "Locus PC-Interface Conn Server," assignee Eric Peterson, and a blank reference field (dual-registered on both 127/tcp and 127/udp with identical service name, description, and assignee). The registration ties to Locus Computing Corporation's PC-Interface (PCI) suite, a legacy Unix-to-PC disk, file, and print-sharing product from the late 1980s and 1990s that was functionally comparable to PC-NFS; the "conn server" component let PC clients connect to an exported disk partition on a Unix host. The product line was later rebranded (Locus's "PC-Enterprise" and IBM's "AIX Access for DOS Users"), and Locus Computing itself was folded into Platinum Technology, which IBM acquired in the late 1990s — so this is a dormant historical registration rather than an actively used modern service. The IANA reference field is blank, and the registry records no RFC for it. For an analyst, port 127 is easy to confuse with the loopback address block 127.0.0.0/8, but the two are unrelated: one is a transport-layer port number, the other an IPv4 address range. No current mainstream OS default service, actively maintained product, or documented malware/backdoor family is known to bind UDP/127 under this registration, and it does not appear on major internet-scan "top exposed ports" lists. Unsolicited traffic to UDP/127 on a modern network is therefore more plausibly generic internet background-radiation or scanning noise than the legacy Locus service actually running. Legacy port-warning aggregator sites list it only under its registered locus-con name with no malicious-use annotation. Treat a responsive UDP/127 as an anomaly worth a second look rather than a routine service.
- IANA assignment
locus-con— "Locus PC-Interface Conn Server"; reference (blank — no RFC cited in IANA registry); assignee Eric Peterson; dual-registered 127/tcp + 127/udp with identical fields [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cached CSV; live .txt export)- Range class
- well-known (0–1023) [Confirmed]
- Registration date
- Unknown (blank in IANA registry — not fabricated)
- Modification date
- Unknown (blank in IANA registry)
- Prevalence
- nmap-services observed open-frequency 127/udp ≈ 0.000412 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 127/tcp side is rarer at ≈ 0.000113 [Confirmed] — nmap-services dataset; the port is not on major internet-scan top-exposed-ports lists[Likely] — auditmypc, port-lookup aggregators
- Related ports
- 127/tcp (identical registration); contrast the loopback address block 127.0.0.0/8 (unrelated — an IPv4 range, not a port)
Primary use
the "conn server" component of Locus Computing Corporation's PC-Interface (PCI) suite — a legacy Unix-to-PC disk/file/print sharing product (comparable to PC-NFS), later rebranded as Locus PC-Enterprise / IBM AIX Access for DOS Users
Security implications
no known malware/trojan/backdoor family associated in the reference lists checked; not a top-scanned port; legacy product is essentially never deployed today, so unsolicited traffic reads as scanning/background noise rather than the real service
Typically seen on
no modern deployment identified; a responsive UDP/127 is an anomaly
- Analyst note
- Do not conflate port 127 with the 127.0.0.0/8 loopback address block. This is a dormant historical registration; treat an open UDP/127 as worth investigating, not a normal service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| locus-con | UDP | Locus PC-Interface Conn Server | 0.04% |
| locus-con | TCP | Locus PC-Interface Conn Server | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.