369
Summary
- // if you see it open
- Niche/research deployment. As a service registry, port 369 can be a reconnaissance target (querying the portmapper enumerates which RPC2 services run on a host — a generic portmapper-family concern), but Coda's real-world deployment is tiny, so practical relevance is low.
- // analyst note
- An open 369 indicates a Coda filesystem host; if you aren't running Coda/RPC2, firewall it and investigate.
About port 369/tcp.
Port 369/tcp is registered with IANA as rpc2portmap with the description "rpc2portmap," no assignee or contact on record (both fields are empty in the registry), and a blank reference field (dual-registered on TCP and UDP). It maps RPC2 service identifiers to ports for the Coda distributed filesystem. Coda, from Carnegie Mellon University, is built on the RPC2 library and descends from the Andrew File System (AFS) lineage; the rpc2portmap daemon is the directory or registry that a client queries first to locate an RPC2 service, and the CMU source defines port 369 for rpc2portmap alongside companion ports such as 370 (codaauth2), 2430/2431 (venus client cache and its side-effect channel), and 2432/2433 (codasrv and its side-effect channel). In practice rpc2portmap runs over UDP 369. The IANA reference field is blank, and notably the registry carries no registrant for this assignment. Security-wise Coda is a niche, largely research deployment; as a service registry, port 369 can be a reconnaissance target because an attacker querying the portmapper can enumerate which RPC2 services run on a host — a generic concern for portmapper-style services in the RPC family — but Coda's real-world deployment is tiny, so practical relevance is low. For an analyst, an open 369 indicates a Coda filesystem host; if Coda or RPC2 is not in use, there is no reason for it to be open, so it should be firewalled and investigated.
- IANA assignment
rpc2portmap— "rpc2portmap"; reference (blank — no RFC cited in IANA registry); NO assignee/contact on record (both empty); dual-registered 369/tcp + 369/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency ~0.000013 tcp (UDP slightly higher) (de-facto) [Well-established] — nmap-services file
- Related ports
- 370 (codaauth2), 2430/2431 (venus), 2432/2433 (codasrv)
Primary use
RPC2 service-to-port mapping for the Coda distributed filesystem
Other/unofficial uses
none meaningful [Well-established]
Security implications
niche/research; portmapper-style enumeration/recon target; Coda deployment is tiny so low practical relevance [Well-established]
Typically seen on
Coda filesystem hosts
- Analyst note
- An open 369 indicates a Coda filesystem host; if you aren't running Coda/RPC2, firewall it and investigate.
About port 369/udp.
Port 369/udp carries rpc2portmap, the Coda RPC2 portmapper — the service registry that Coda distributed-filesystem clients query first to locate an RPC2 service — and it should be treated as internal-only rather than exposed to the public internet, in line with other portmapper-family services.
IANA's registry lists 369/udp as rpc2portmap, dual-registered identically on 369/tcp; the Reference field is blank (no RFC cited) and no assignee or contact is on record. RPC2 is Coda's own RPC library, not the ONC/Sun RPC family: CMU's ports.h defines PORT_rpc2portmap 369 alongside PORT_codaauth2 370 and the venus/codasrv ports 2430–2433, and rpc2portmap runs over UDP 369 in practice — making this UDP entry the operative one for the service, with 369/tcp as its dual-registered sibling. (See the repo's finalized port-369-tcp.md for the same CMU-sourced identification.)
No independent scanning or honeypot telemetry for UDP/369 was located, and a SpeedGuide.net community ports lookup returned HTTP 403; the primary identification instead rests on the CMU Coda source (ports.h), consistent with the 369/tcp sibling.
- IANA assignment
rpc2portmap— description "rpc2portmap"; Reference field blank; Assignee and Contact both blank; dual-registered 369/tcp + 369/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- Unknown — no nmap-services or scan-telemetry data was located for UDP/369 in this research pass [Unknown]
- Related ports
- 370/tcp,udp (codaauth2); 2430/2431 (venus + side effects); 2432/2433 (codasrv + side effects); 369/tcp (dual-registered sibling) [Confirmed dual-registration; Well-established Coda cluster] — CMU Coda source, IANA registry
Primary use
Coda RPC2 portmapper — maps RPC2 service identifiers to ports for the Coda distributed filesystem (CMU, AFS lineage); runs over UDP 369 in practice
Other/unofficial uses
none meaningful — Coda's real-world deployment is niche/research-only [Well-established]
Security implications
Niche/research deployment; as a service registry, port 369 can be a reconnaissance target (querying the portmapper enumerates which RPC2 services run on a host — a generic portmapper-family concern), but Coda's real-world deployment is tiny, so practical relevance is low
Typically seen on
Coda filesystem hosts [Well-established]
- Analyst note
- An open 369/udp indicates a Coda filesystem host; if Coda/RPC2 is not in use, there is no reason for it to be open — firewall it and investigate, and correlate with the related Coda ports (370, 2430–2433).
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| rpc2portmap | UDP | — | 0.07% |
| rpc2portmap | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.