311
Summary
- // if you see it open
- Obsolete. The administration channel was generally unencrypted unless tunneled/SSL-wrapped, so an exposed 311 was historically a plaintext remote-admin surface. AppleShare IP and classic Mac OS are long dead; real-world relevance is essentially nil.
- // analyst note
- An open 311 today usually means a forgotten legacy Mac server or something masquerading as one; investigate, then close.
About port 311/tcp.
Port 311/tcp is registered with IANA as asip-webadmin with the description "AppleShare IP WebAdmin," assignee Ann Huang (Apple), and a blank reference field (dual-registered on TCP and UDP). It is the port for browser-based remote administration of AppleShare IP servers. AppleShare IP was Apple's late-1990s file, print, mail, and web server suite for classic Mac OS, extending the older AppleTalk-based AppleShare to run over TCP/IP, and port 311 carried its web-based admin interface; the same port number later persisted in Mac OS X Server's administration tooling (Server Admin, Workgroup Manager, Server Monitor, Xsan Admin), per Apple's port documentation, allowing an administrator to configure file sharing, web, mail, and user accounts. The IANA reference field is blank. Security-wise the port is obsolete: the administration channel was generally unencrypted unless tunneled or SSL-wrapped, so an exposed port 311 historically represented a plaintext remote-admin surface, but AppleShare IP and classic Mac OS are long dead and real-world relevance today is essentially nil. For an analyst, an open 311 today usually means a forgotten legacy Mac server, or something masquerading as one, so it is worth investigating and then closing.
- IANA assignment
asip-webadmin— "AppleShare IP WebAdmin"; reference (blank — no RFC cited in IANA registry); assignee Ann Huang (Apple); dual-registered 311/tcp + 311/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency ~0.001857 (de-facto) [Well-established] — nmap-services file
- Related ports
- 548 (AFP/AppleShare file sharing), 427 (SLP discovery), 660 (mac-srvr-admin), 687 (asipregistry)
Primary use
web-based remote administration of AppleShare IP servers; obsolete
Other/unofficial uses
reused by later Mac OS X Server admin tools (Server Admin, Workgroup Manager) [Well-established]
Security implications
obsolete; admin channel generally unencrypted unless tunneled; classic Mac OS/AppleShare IP long dead [Well-established]
Typically seen on
legacy classic Mac OS AppleShare IP servers; later Mac OS X Server
- Analyst note
- An open 311 today usually means a forgotten legacy Mac server or something masquerading as one; investigate, then close.
About port 311/udp.
Port 311/udp carries asip-webadmin, IANA's registration for AppleShare IP WebAdmin, and it has no place on the modern public internet: the service is a legacy, browser-based admin interface for a discontinued Apple server product, so any live response on it today deserves scrutiny rather than routine exposure.
IANA registers port 311 on both tcp and udp under the identical service name and description, assignee and contact "Ann Huang," with no RFC or reference cited and no registration or modification date published. AppleShare IP was Apple's TCP/IP file, web, and mail server suite for classic Mac OS, roughly 1998–2002, later superseded by Mac OS X Server; asip-webadmin was its point-a-browser-at-port-311 administration console.
No source found describes a distinct UDP-specific use of 311 separate from the TCP web-admin history — the UDP side appears to simply ride along with the shared IANA service-name entry rather than reflecting an independently active protocol. Treat it as a legacy reservation, not a confirmed live UDP service.
Because AppleShare IP has been discontinued for roughly two decades, intentional exposure of this port today is expected to be rare; a responsive host is more likely a misconfigured legacy system or a coincidental service squatting the port than an active AppleShare deployment.
- IANA assignment
asip-webadmin— "AppleShare IP WebAdmin"; reference (blank — no RFC cited); assignee/contact Ann Huang; dual-registered 311/tcp + 311/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=311- Range class
- well-known (0–1023)
- Prevalence
- not sourced in this research pass [Unknown]
- Related ports
- not sourced in this research pass [Unknown]
Primary use
browser-based web administration console for AppleShare IP (Apple's discontinued classic-Mac-OS file/web/mail server suite, circa 1998–2002)
Other/unofficial uses
none documented beyond the AppleShare IP admin interface
Security implications
legacy, unencrypted HTTP admin interface; should not be internet-facing; no CVEs found specific to this port
Typically seen on
legacy AppleShare IP / classic Mac OS server deployments, now effectively obsolete
Malware associations
none found in this research pass
Exposure
Restricted — a legacy admin console should be limited to trusted/internal networks, never publicly reachable
- UDP-specific note
- no independently documented UDP use; appears to piggyback on the shared TCP/UDP IANA registration [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=311
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| asip-webadmin | TCP | appleshare ip webadmin | 0.19% |
| asip-webadmin | UDP | appleshare ip webadmin | 0.05% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.