513

Port 513/tcp is registered with IANA as login with the verbose description "remote login a la telnet; automatic authentication performed based on priviledged port numbers and distributed data bases which identify \"authentication domains\"" — the registry literally contains the misspelling "priviledged" — with blank assignee, contact, and reference fields. It is the Berkeley rlogin service (rlogind), implementing RFC 1282 (BSD Rlogin, December 1991, which obsoletes RFC 1258), and it provides a remote-echoed, locally flow-controlled virtual terminal between Unix hosts over TCP contact port 513, with the client sending four null-terminated strings on connect. Its defining feature — and weakness — is that it can bypass passwords entirely when the connection originates from a trusted host, established via a privileged source port plus .rhosts or hosts.equiv trust files. A critical disambiguation is that the UDP sibling on this number is a different service: 513/udp is who (rwho/rwhod), which "maintains data bases showing who's logged in to machines on a local net and the load average of the machine" — this entry is 513/tcp login. The IANA reference field is blank (the protocol is documented in RFC 1282, but the registry row cites no reference). Security-wise this is the classic trust-based attack surface: RFC 1282's own cautionary note warns that trusted-host password bypass "has been successfully exploited in previous attacks on the internet" and that compromising one host opens all hosts configured to trust it, and specific risks include .rhosts/hosts.equiv "+ +" misconfiguration, DNS or network compromise letting an untrusted host masquerade as trusted, and TCP source-address spoofing (the technique Robert T. Morris described in 1985) — all over cleartext. For an analyst, an open 513/tcp marks a host honoring Berkeley trusted-host login; audit .rhosts and hosts.equiv, treat it as high-risk, and migrate to SSH.

IANA assignment

login — "remote login a la telnet; automatic authentication performed based on priviledged port numbers and distributed data bases which identify \"authentication domains\"" (registry misspells "priviledged"); reference (blank — RFC 1282 is the defining spec but is NOT cited in the registry row); assignee/contact blank; dual-registered 513/tcp + 513/udp, but 513/udp is a DIFFERENT service (who/rwho)

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.005595 (de-facto) [Well-established] — nmap-services file

Related ports

512 (exec/rexec), 514 (shell/rsh) — the r-services trio; 543 (klogin, Kerberized); 22 (SSH); 513/udp (who/rwho — different)

Primary use

BSD remote interactive terminal login (rlogind, RFC 1282)

Other/unofficial uses

none meaningful; superseded by SSH [Well-established]

Security implications

trusted-host password bypass (.rhosts/hosts.equiv "+ +"); host-masquerade via DNS/network compromise; TCP source-address spoofing (Morris 1985); cleartext; RFC 1282 warns it has been exploited

Typically seen on

legacy Unix/Linux (Solaris, AIX, HP-UX, old Red Hat) running in.rlogind

Analyst note

An open 513/tcp marks a host honoring Berkeley trusted-host login; audit .rhosts/hosts.equiv, treat as high-risk, and migrate to SSH.

Port 513/udp carries the who (rwho) service; it should stay internal-only rather than exposed to the public internet. IANA registers 513/udp as who, described as maintaining "data bases showing who's logged in to machines on a local net and the load average of the machine," with a blank reference field and no listed assignee.

The port is closely tied to 513/tcp, which IANA separately registers as login — the rlogin remote-login protocol. The two are distinct services sharing a port number: TCP 513 is interactive remote login, while UDP 513 is a local-network status broadcast; they are not the same protocol on two transports.

In practice, UDP 513 is served by rwhod, the BSD "remote who" daemon shipped with 4.3BSD and its descendants. rwhod periodically broadcasts the list of currently logged-in users, their terminals, and idle/login time to other hosts on the local network, and it answers queries from the rwho and ruptime client commands. No other software is commonly reported using this port; it is a single-purpose legacy Unix service rather than one reused by varied applications.

who/rwho has fallen out of use as SSH-based tooling replaced remote-login and status workflows, and current guidance treats an open UDP 513 as primarily a legacy or misconfiguration signal rather than a normal production service.

Exposure

rwhod broadcasts a list of logged-in usernames, terminals, and session times to any host that queries it, without authentication — treat 513/udp as internal-only and never expose it to the public internet.

Information disclosure

an open 513/udp discloses valid usernames and active hosts on the local network, which is useful reconnaissance for an attacker (Likely, per community port-reference sources).

Legacy status

as of an August 2026 search, sources describe rwho/UDP 513 as obsolete, with usage declining sharply in favor of SSH-based remote-login and status tooling.

Malware/trojan association

no credible source found associating 513/udp with a specific named malware family or trojan as of an August 2026 search.

IANA assignment

who — "maintains data bases showing who's logged in to machines on a local net and the load average of the machine"; reference (blank); assignee (blank) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry who 513/udp

Dual registration

513/tcp is separately registered as login (rlogin — "remote login a la telnet; automatic authentication performed based on priviledged port numbers...") [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry login 513/tcp

Range class

system/well-known (0–1023) [Confirmed] — this site's own tooling (port 513, range "system")

Prevalence

nmap-services open-frequency for 513/udp (who, "BSD rwhod(8)") ≈ 0.002323 (~0.23%) [Confirmed] — this site's own tooling (port 513, udp service entry)

Related ports

513/tcp (login/rlogin), 512/tcp (exec), 514/tcp (shell/rsh) — the BSD r-commands cluster [Confirmed/Likely] — the IANA Service Name and Transport Protocol Port Number Registry login 513/tcp

Primary use

BSD who/rwho service — rwhod broadcasts logged-in-user info on the local network and answers who/rwho/ruptime client queries

Other/unofficial uses

none reported; single-purpose legacy service, not reused by other applications

Security implications

unauthenticated broadcast of usernames/session data enables local-network reconnaissance; obsolete relative to SSH-based tooling

Typically seen on

legacy BSD/Unix hosts on local networks; rare on modern or internet-facing hosts

Analyst note

An open 513/udp outside a trusted LAN is a legacy exposure signal — investigate as an old BSD/Unix host or misconfiguration rather than a normal internet-facing service.