512

Port 512/tcp is registered with IANA as exec with the verbose description "remote process execution; authentication performed using passwords and UNIX login names" and blank assignee, contact, and reference fields. It is the Berkeley rexec service (rexecd / in.rexecd), one of the classic Unix r-commands: the client, via the rexec() library call, supplies a username and password in cleartext plus a command string, the daemon authenticates against the normal Unix login/password database and runs the command, and a secondary port is opened for stderr. The r-command suite premiered in BSD (broadly deployed from 4.2BSD, 1983). A critical disambiguation is that the UDP sibling on this number is a different service entirely: 512/udp is comsat/biff ("used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine"), which is local new-mail notification unrelated to remote execution — this entry is 512/tcp exec. The IANA reference field is blank. Security-wise, cleartext username and password traverse the network and are trivially sniffable, the service is brute-forceable (Metasploit and nmap have rexec brute-force tooling), and it is part of the universally deprecated r-services family; the 1988 Morris worm exploited rexec by guessing that a remote account reused the local password. For an analyst, an open 512/tcp signals an unhardened legacy Unix host exposing cleartext remote execution — a serious finding — and rexecd should be disabled in favor of SSH.

IANA assignment

exec — "remote process execution; authentication performed using passwords and UNIX login names"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 512/tcp + 512/udp, but 512/udp is a DIFFERENT service (comsat/biff)

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000841 (de-facto) [Well-established] — nmap-services file

Related ports

513 (login/rlogin), 514 (shell/rsh) — the r-services trio; 543/544 (klogin/kshell, Kerberized); 22 (SSH, the replacement); 512/udp (comsat/biff — different)

Primary use

BSD remote command execution with cleartext credentials (rexecd)

Other/unofficial uses

none meaningful; superseded by SSH [Well-established]

Security implications

cleartext username+password (sniffable), brute-forceable; deprecated r-services family; Morris worm (1988) abused rexec password reuse [Well-established/Threat-reported]

Typically seen on

legacy Unix (Solaris, AIX, HP-UX, old Linux) running in.rexecd

Analyst note

An open 512/tcp signals an unhardened legacy Unix host exposing cleartext remote execution — a serious finding; disable rexecd and replace with SSH.

Port 512/udp carries the legacy Unix comsat/biff mail-notification service, and it should stay internal-only rather than be exposed to the public internet.

The comsat daemon listens on 512/udp for short, unauthenticated datagrams sent by a local mail transfer agent (such as sendmail) whenever new mail arrives for a user. It looks up that user's active terminal session and writes a short excerpt of the message header directly to the terminal — a mechanism a user enables per-session with the biff y command, which is where the paired service name comes from. Registry documentation describes it as traditionally receiving messages only from processes on the same machine, i.e. designed for local/loopback use, not network exposure.

Port 512 is dual-registered but not dual-purpose: 512/tcp is a wholly different service, exec (remote process execution), part of the classic BSD r-commands family alongside 513 (login/who) and 514 (shell/syslog). The udp/512 comsat listener should not be confused with the tcp/512 exec listener.

comsat/biff is largely obsolete today, superseded by IMAP/POP3 pull-based mail access and GUI clients with their own push notifications. It ships disabled by default on modern Linux and BSD distributions, requiring an administrator to uncomment the comsat line in inetd.conf before it will run at all.

Exposure

Internal-only — comsat is documented as accepting datagrams only from processes on the same host and was never designed for network-facing use.

Authentication

None — comsat performs no sender verification, so any process able to reach the listener can send a spoofed new-mail notification.

Default state

Disabled by default on modern distributions; GNU inetutils' inetd-comsat must be explicitly uncommented in /etc/inetd.conf (Debian/Ubuntu) to run.

Vulnerability status

No CVE specific to comsat/biff on 512/udp is recorded in mainstream vulnerability databases as of an August 2026 search.

Malware association

No credible source ties 512/udp comsat/biff traffic to malware or trojans as of an August 2026 search.

IANA assignment

comsat / biff, co-registered on 512/udp; description "used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine"; assignee and reference fields blank in the registry

[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry comsat 512/udp

Dual registration

512/tcp registers a distinct, unrelated service, exec (remote process execution) — not comsat/biff [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry exec 512/tcp

Range class

system/well-known (0–1023) [Confirmed] — this site's own tooling

Prevalence

nmap-services open-frequency 512/udp ≈ 0.002142 (~0.21%) [Confirmed] — this site's own tooling

Current status

described by port-reference aggregators as largely obsolete, superseded by IMAP/POP3 and GUI mail clients; not enabled by default on modern distributions [Likely] — https://whatportis.com/ports/512_comsat-together-with-biff

Related ports

512/tcp (exec, distinct service); 513/tcp login, 513/udp who; 514/tcp shell, 514/udp syslog — the classic BSD r-commands service cluster

Primary use

legacy Unix mail-notification daemon; local MTA sends a UDP datagram to comsat on new mail, comsat writes an excerpt to the recipient's active terminal if biff y was set

Other/unofficial uses

bundled into BSD/GNU inetd-family super-server suites — OpenBSD inetd (comsat(8)/biff(1)), NetBSD inetd.conf, GNU inetutils' inetutils-inetd on Debian/Ubuntu

Security implications

unauthenticated, unencrypted UDP service with no sender verification; one aggregator (whatportis.com) assigns a "caution" risk rating and recommends blocking external UDP access; no CVE or malware association found as of an August 2026 search

Typically seen on

older/legacy Unix and BSD hosts running inetd with comsat explicitly enabled; rare on current systems

Analyst note

An externally reachable 512/udp is unexpected for a service intended for same-host delivery only; treat as legacy misconfiguration or exposure rather than normal internet-facing traffic.