177
Summary
- // if you see it open
- Unencrypted like telnet — cleartext authentication enables credential capture, spoofing, MITM, and session hijacking. Leaks host/system info and is a UDP amplification vector (~7x per Shadowserver; the response is generated whether Willing or Unwilling). Never internet-expose; disabled by default on modern distros; use SSH-tunneled X.
- // analyst note
- An accessible XDMCP responder (especially 177/udp) is a Unix/Linux host offering remote graphical login — a hardening finding and a DDoS-reflector liability. Disable unless required and confine to a trusted LAN.
About port 177/tcp.
Port 177/tcp is registered with IANA as xdmcp with the description "X Display Manager Control Protocol," assignee Robert W. Scheifler (the X Window System author), and a blank reference field (dual-registered on TCP and UDP). XDMCP lets an X terminal or autonomous X display discover and request graphical login sessions from a remote X display manager such as xdm, gdm, kdm, SDDM, or LightDM: the X server sends a Query (or BroadcastQuery/IndirectQuery), the display manager replies Willing or Unwilling, and a Request/Accept exchange then starts a managed session — the X server behaving like a graphical telnet client and the display manager like a telnet server. A practical detail that matters for triage is that XDMCP runs predominantly over UDP port 177 (the X.Org specification designates UDP 177); this entry is the TCP registration, while the live protocol is the UDP sibling, with the actual X11 session traffic carried on 6000–6063. The IANA reference field is blank. Security-wise XDMCP is unencrypted like telnet, so authentication happens in cleartext and snooping enables credential capture, spoofing, man-in-the-middle, and session hijacking; it also leaks host and system information and is a UDP amplification vector, with Shadowserver reporting roughly 7x amplification (the response is generated whether Willing or Unwilling). It should never be internet-exposed and is disabled by default on modern distributions, with SSH-tunneled X the recommended alternative. For an analyst, an accessible XDMCP responder — especially on UDP 177 — indicates a Unix/Linux host offering remote graphical login, both a hardening finding and a DDoS-reflector liability that should be disabled unless explicitly required and confined to a trusted LAN.
- IANA assignment
xdmcp— "X Display Manager Control Protocol"; reference (blank — no RFC cited in IANA registry); assignee Robert W. Scheifler; dual-registered 177/tcp + 177/udp (UDP is the operational transport) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- low; present in nmap UDP top-ports; uncommon as open TCP (de-facto) [Well-established] — nmap-services file
- Related ports
- 6000–6063 (X11 display sockets); 177/udp sibling (operationally relevant)
Primary use
remote X11 graphical login session management (X.Org XDMCP)
Other/unofficial uses
X terminal / thin-client login brokering [Well-established]
Security implications
unencrypted (cleartext auth → snoop/MITM/hijack); information disclosure; UDP amplification (~7x, Shadowserver); never internet-expose; disabled by default on modern distros; use SSH-tunneled X
Typically seen on
Unix/Linux hosts with X11 remote login (xdm/gdm/kdm)
- Analyst note
- An accessible XDMCP responder (especially 177/udp) is a Unix/Linux host offering remote graphical login — a hardening finding and a DDoS-reflector liability. Disable unless required and confine to a trusted LAN.
About port 177/udp.
Port 177/udp is registered with IANA as xdmcp, "X Display Manager Control Protocol," assignee and contact Robert W. Scheifler, with a blank reference field and dual registration on 177/tcp carrying the identical name, description, assignee, and contact. XDMCP is the negotiation and query protocol X display managers use to discover and manage remote graphical login sessions: a client (an X terminal, or an X server acting as one) broadcasts or directs a Query/BroadcastQuery packet to port 177/udp, and a listening display manager (xdm, gdm, kdm, and similar) replies, ultimately handing off to a session that runs the actual X11 protocol over separate TCP ports. It is implemented across Unix/Linux desktop stacks and by X-server products used from Windows, including NetSarang Xmanager/Xshell and Cygwin/X's XLaunch. XDMCP predates modern transport security and carries no native encryption, so it is intended for trusted local networks rather than the open internet. Internet-facing XDMCP responders are actively tracked: Shadowserver Foundation runs an "Accessible XDMCP Service Report" that scans for exposed instances and rates them high severity, both because they leak host/session information to unauthenticated queriers and because a responding UDP service (including ones that answer "Unwilling") can be abused as a reflection/amplification vector in DDoS attacks, given the reply is markedly larger than the query. Vendor guidance for enterprise Unix systems generally recommends disabling or firewalling XDMCP unless it is actively needed on a trusted segment.
- IANA assignment
xdmcp— "X Display Manager Control Protocol"; reference (blank — no RFC cited in IANA registry); assignee/contact Robert W. Scheifler; dual-registered 177/tcp + 177/udp with identical fields [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry lines 439–440 (cached IANA Service Name and Transport Protocol Port Number Registry)- Range class
- well-known (0–1023) [Confirmed] — same registry
- Registration/modification dates
- blank in the IANA registry source; not fabricated [Confirmed — Unknown] — the IANA Service Name and Transport Protocol Port Number Registry line 440
- Related ports
- 177/tcp (identical dual registration); X11 session ports 6000–6063/tcp
Primary use
negotiation/query protocol for X Window System (X11) display managers (xdm/gdm/kdm) to discover and initiate remote graphical login sessions; actual X11 session traffic runs over separate TCP ports
Common software
Unix/Linux X display managers (xdm, gdm, kdm); Windows-side X servers/SSH-X clients such as NetSarang Xmanager/Xshell; Cygwin/X XLaunch [Confirmed] — https://netsarang.atlassian.net/wiki/spaces/ENSUP/pages/110854321/How+to+change+the+default+UDP+port+(%23+177)+for+XDMCP+connection, https://x.cygwin.com/docs/xlaunch/xdmcp.html
Security implications
no native encryption, designed for trusted local networks; internet-exposed responders (including "Unwilling" replies) are usable for UDP amplification/reflection DDoS at roughly 7x query payload size; classified HIGH severity by Shadowserver's continuous internet-wide Accessible XDMCP Service Report [Confirmed] — https://www.shadowserver.org/what-we-do/network-reporting/accessible-xdmcp-service-report/, https://xdmcpscan.shadowserver.org/
Typically seen on
legacy/enterprise Unix and Linux hosts running remote X sessions; cross-platform SSH/X client software connecting to those hosts
- Hardening guidance
- vendor/support documentation for enterprise Unix systems (e.g., Teradata) advises disabling or firewalling XDMCP when not required on trusted networks; the specific KB article's publish date is Unknown[Likely] — https://support.teradata.com/knowledge?id=kb_article_view&sys_kb_id=37ad12bf47fca5508cf4f352846d432f
- Analyst note
- an internet-reachable 177/udp is anomalous outside intentionally trusted remote-desktop deployments and should be treated as both an information-disclosure and DDoS-amplification risk, consistent with Shadowserver's high-severity classification.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| xdmcp | UDP | X Display Manager Control Protocol | 1.86% |
| xdmcp | TCP | X Display Mgr. Control Proto | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.