538

Port 538/tcp carries gdomap, the GNUstep Distributed Objects name/lookup daemon; it should stay internal-only rather than be exposed to the public internet.

IANA registers 538 for both TCP and UDP under the service name gdomap, assignee Richard Frith-Macdonald, with a blank Reference field and no listed RFC. The description field simply reads "gdomap."

gdomap is part of the GNUstep base libraries, the open-source Objective-C/Cocoa-compatible framework project. Its manpage describes it as the daemon "used by GNUstep programs to look up distributed objects of processes running across the network (and between different user accounts on a single machine)", usually started at system boot and binding itself to port 538. It also probes every machine on the local network, class-C scoped, to see whether another gdomap is running, with a -c configuration file listing hosts as the alternative. That role is functionally similar in role to Sun RPC's portmapper/rpcbind, but scoped to GNUstep's own distributed-objects mechanism rather than a general-purpose service.

No other software was found reported as commonly generating traffic on this port; it is a narrow, single-project assignment rather than one with broad multi-vendor usage. No malware or trojan association, and no independent scanning/prevalence statistics beyond the nmap-services sample, were located as of an August 2026 search.

Exposure

A lookup/registration service for distributed-object servers has no legitimate reason to be reachable from the public internet; it belongs on a trusted local network at most, alongside other RPC-style directory services. [Likely]

Notable CVE

CVE-2014-2980 — a denial-of-service in GNUstep Base 1.24.6 and earlier where gdomap.c mishandles the logger's file descriptor on an invalid request in daemon mode, crashing the daemon (GitHub Advisory GHSA-x7c6-24q2-hp35). An earlier local file-disclosure issue in GNUstep Base before 1.20.0 let a local user read arbitrary file contents via gdomap's -c/-a options. Both are vulnerabilities in the gdomap daemon, not in the port itself.

Malware association

None found; auditmypc.com's port-538 page returned only its standard boilerplate caveat text, with no verdict line located for this port (https://www.auditmypc.com/tcp-port-538.asp).

Prevalence

Measured open-frequency is very low (see Fields), consistent with a niche, single-project service rather than something routinely scanned or targeted.

IANA assignment

gdomap — description "gdomap"; reference (blank); assignee Richard Frith-Macdonald; dual-registered 538/tcp + 538/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry gdomap 538/tcp

Range class

system/well-known (0–1023) [Confirmed] — this site's own tooling

Prevalence

nmap-services open-frequency 538/tcp = 0.000063 (~0.0063%); 538/udp = 0.000461 (~0.046%) [Confirmed] — this site's own tooling

Related ports

RPC/directory-lookup analogues such as 111 (rpcbind/portmapper), 135 (MS RPC endpoint mapper)

Primary use

GNUstep Distributed Objects name/lookup daemon, started at system boot and binding to port 538, used by GNUstep programs to look up distributed objects across the network and between user accounts on one machine [Confirmed] — https://manpages.debian.org/stretch/gnustep-base-runtime/gdomap.8.en.html, https://github.com/gnustep/libs-base/blob/master/Tools/gdomap.8

Other/unofficial uses

none found; narrowly scoped to the GNUstep project [Unknown]

Security implications

not designed for public exposure; a directory/lookup service for a distributed-objects framework, analogous in role to RPC portmapper-style services. CVE-2014-2980 is a denial of service in GNUstep Base 1.24.6 and earlier — Tools/gdomap.c in daemon mode mishandles the logger's file descriptor, letting a remote attacker abort the daemon with an invalid request (CWE-20) — and an earlier issue before GNUstep Base 1.20.0 let a local user read arbitrary files via gdomap's -c/-a options; both are software defects, not properties of the port. No malware association found as of an August 2026 search

Typically seen on

hosts running GNUstep-based applications (Objective-C/Cocoa-compatible framework stack)

Analyst note

An open 538/tcp on the public internet is unusual and worth checking for a misconfigured or forgotten GNUstep deployment rather than assuming a standard service.