411
Summary
- // typical exposure
- Restricted (trusted networks only) — Neither confirmed use case is meant for open public exposure: the formal rmt registration implies a trusted host-to-host administrative protocol, and the de facto Direct Connect/DC++ hub use carries reported unencrypted-traffic, weak-authentication, and malware-distribution risks that argue for keeping it limited to trusted peers/networks rather than freely public.
- // common applications
- Direct ConnectDC++ApexDC++StrongDC++jDCCAirDC++ Traffic on this port is most often associated with Direct Connect-style peer-to-peer file sharing; DC++ and its forks (ApexDC++, StrongDC++, jDCC, AirDC++) have been reported by community sources as defaulting to 411 for hub connections, distinct from the port's formal IANA 'rmt' registration.
- // analyst note
- Treat 411/tcp as dual-natured — a thinly documented IANA
rmtregistration overshadowed in practice by its role as a Direct Connect/DC++ hub port; an unexpected listener should be checked against both possibilities rather than assumed benign. - // if you see it open
- Community sources describe classic Direct Connect/DC++ traffic on this port as unencrypted by default (eavesdropping/MITM exposure), with weak or absent authentication in some client/hub implementations (enabling impersonation) and no central vetting of shared files (malware-distribution risk). An older, unattributed legacy port-reference page tags TCP 411 as historically associated with a Trojan/virus, but no primary malware-sample source was found in this pass — treat as unverified. The formal 'rmt' registration itself carries no documented vulnerabilities in the sources reviewed.
About port 411/tcp.
Port 411/tcp is officially registered with IANA as rmt (Remote MT Protocol), assigned to Peter Eriksson, with no RFC listed in the registry's Reference field; in day-to-day practice, however, it is far better known as the default hub port for the Direct Connect (DC++) peer-to-peer file-sharing protocol. Neither use case argues for leaving it openly exposed to the public internet without restriction.
The IANA registration itself is confirmed but thin: the entry, dual-registered on 411/udp as well, names Peter Eriksson as both assignee and contact and carries no citable RFC or protocol specification, so the formal purpose behind the name cannot be verified beyond the label itself.
The dominant real-world usage diverges sharply from that registration. Multiple port-lookup and scanning-reference sites describe 411/tcp as the conventional hub port for Direct Connect and its DC++-derived forks — including ApexDC++, StrongDC++, jDCC, and AirDC++ — several of which are reported as no longer actively maintained. This association comes from a single class of secondary sources and was not independently cross-verified in this research pass.
- IANA assignment
rmt— "Remote MT Protocol"; reference (blank — no RFC cited in IANA registry); assignee/contact Peter Eriksson; dual-registered 411/tcp + 411/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency for 411/tcp ≈0.000088 [Confirmed] — nmap-services dataset (this site's own tooling)
- Related ports
- 411/udp (same rmt dual registration) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry
Primary use
officially rmt (Remote MT Protocol) per IANA; no RFC or protocol document cited
Other/unofficial uses
default hub port for Direct Connect (DC++) peer-to-peer file sharing and forks ApexDC++, StrongDC++, jDCC, AirDC++ (several reportedly unmaintained)
Security implications
no default encryption on classic DC++ traffic; weak/absent authentication in some client/hub implementations; no content vetting on shared files (malware-distribution risk); an unattributed legacy claim ties TCP 411 to a Trojan/virus but no primary sample source was found
Typically seen on
Direct Connect/DC++ hub-hosting servers; legacy Unix remote-tape (rmt/rdump/rrestore) backup workflows per the formal registration [Likely]
- Analyst note
- Treat 411/tcp as dual-natured — a thinly documented IANA
rmtregistration overshadowed in practice by its role as a Direct Connect/DC++ hub port; an unexpected listener should be checked against both possibilities rather than assumed benign.
About port 411/udp.
Port 411/udp is registered with IANA as rmt (Remote MT Protocol), and traffic on it is most plausibly legacy Unix remote-tape-backup activity; the protocol was designed for trusted administrative use and should stay off the public internet rather than be exposed there.
The IANA registry lists 411/udp under the service name rmt, description "Remote MT Protocol," assignee Peter Eriksson, with a blank Reference field — no RFC is cited for this registration — and 411/tcp carries the same dual registration.
In practice, rmt is the Unix remote-magtape server program invoked by tar, cpio, mt, dump, and restore so those tools can read or write a tape drive attached to a different host over the network. Historically it was started via rexec/rsh (rcmd) rather than run as a standing, authenticated daemon.
A separate, unofficial community convention also reports port 411 as the default hub port for Direct Connect (DC/DC++) peer-to-peer file-sharing software, with UDP used for active searches and TCP 412 for client-to-client transfers; DC++ auto-increments past 411/412/413 if those ports are already bound. This is explicitly a community convention, not an IANA assignment, and it conflicts with the registered rmt use.
A legacy port-lookup reference (auditmypc.com) records no known virus or Trojan association for UDP 411 — its own verdict line reads "Virus / Trojan: No" — and no current CVE or malware family specific to 411/udp surfaced in this research pass.
- IANA assignment
rmt— "Remote MT Protocol"; reference (blank — no RFC cited); assignee Peter Eriksson; dual-registered 411/tcp + 411/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed] — IANA registry
- Prevalence
- nmap-services open-frequency for 411/udp ≈0.000560 [Confirmed] — nmap-services dataset (this site's own tooling)
- Related ports
- 411/tcp (same
rmtdual registration); 412/tcp (DC++ client-to-client transfer, community convention)
Primary use
Unix remote-magtape (rmt) protocol, used by tar/cpio/mt/dump/restore for remote tape backup, historically invoked via rexec/rsh
Other/unofficial uses
community-reported default port for Direct Connect (DC/DC++) P2P hub/search traffic; TCP 412 used for client-to-client transfer
Security implications
rmt's rexec/rsh-based invocation lacks strong built-in auth of its own (restrict to trusted networks); unofficial DC++ alt-use has a different, more internet-facing profile; auditmypc.com's own verdict line for 411/udp reads "Virus / Trojan: No" (none documented)
Typically seen on
legacy Unix/Linux backup servers and clients running tar/dump/restore; possibly DC++ hub hosts if that unofficial use is in play
- Analyst note
- confirm which service is actually listening — legitimate
rmtbackup traffic and unofficial DC++ hub traffic look identical at the port level but imply very different exposure postures.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| rmt | UDP | Remote MT Protocol | 0.06% |
| rmt | TCP | Remote MT Protocol | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.