901

Port 901 is registered with IANA as smpnameres with the description "SMPNAMERES," assignee Leif Ekblad, and a blank reference field on both the TCP and UDP rows (verified against the live registry CSV); the famous real-world use of the port, however, is not the registration but the Samba Web Administration Tool (SWAT), a de-facto use. SWAT was a browser-based UI for editing smb.conf that listened on TCP 901 at a local URL, and it was deprecated and then removed from Samba: per the Samba 4.1.0 release notes (11 October 2013), SWAT was removed as a component, and a leftover Python WSGI web server related to it was later removed entirely by Samba 4.11. SWAT carried documented security issues — CVE-2013-0214, a cross-site request forgery in SWAT affecting Samba 3.0.x through 4.0.1 (fixed 30 January 2013), and the companion CVE-2013-0213 clickjacking weakness, both reported by Jann Horn — and it transmitted passwords in clear text when accessed remotely, so an open 901 serving SWAT indicates a pre-4.1 and therefore very old Samba install. Other historical de-facto uses of 901 include the ISS RealSecure IDS sensor, which listened on 901 for console communications, and some VMware Virtual Infrastructure Client console traffic. The IANA reference field is blank. SpeedGuide and Symantec also list remote-access trojans such as NetDevil and "Pest" against TCP 901, which should be treated only as threat-reported. For an analyst, an open 901 today should be triaged carefully — likely an old SWAT/Samba server, a RealSecure sensor, a VMware console, or a backdoor, none of which should be internet-exposed; nmap-services lists 901/tcp at roughly 0.000552 and labels it samba-swat, the occasional frequency reflecting the SWAT history.

IANA assignment

smpnameres — "SMPNAMERES"; reference (blank); assignee Leif Ekblad; dual-registered 901/tcp + 901/udp [IANA-assigned, verified live] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

occasional; nmap-services 901/tcp ~0.000552 (de-facto, elevated by SWAT history; nmap labels it samba-swat) [Well-established] — nmap-services file

Related ports

139/445 (Samba/SMB)

Primary use (registered)

SMPNAMERES name-resolution service

Other/unofficial uses

SWAT (Samba Web Administration Tool) on TCP 901 — de-facto, removed in Samba 4.1.0 (2013); ISS RealSecure sensor; VMware VI Client console

Security implications

SWAT had CSRF (CVE-2013-0214) and clickjacking (CVE-2013-0213) issues and sent passwords in clear text remotely; removed in Samba 4.1.0 — an open 901 SWAT = very old, insecure Samba; trojan flags (NetDevil/Pest)

Typically seen on

old Samba servers (pre-4.1 SWAT), ISS RealSecure sensors, VMware consoles

Analyst note

An open 901 should be triaged — likely old SWAT/Samba (flag as outdated/insecure), a RealSecure sensor, a VMware console, or a backdoor; none should be internet-exposed.