TCP Port 111 – sunrpc / portmap (RPC Service Directory)
Port 111 is the standard port for the portmap service (also called rpcbind in modern implementations), which acts as a directory for Remote Procedure Call (RPC) services on Unix and Linux systems. RPC is a way for programs on different machines to call functions on each other across a network, originally developed by Sun Microsystems in the 1980s and broadly adopted across Unix systems. Many traditional Unix network services (NFS file sharing, NIS directory information, mountd, statd, and others) are implemented as RPC services rather than as ordinary network protocols.
Where most network protocols use a fixed, well-known port, RPC services traditionally use dynamically assigned ports that change between system reboots. Portmap solves the resulting “where is this service today” problem. When an RPC service starts, it registers itself with the local portmap on port 111, telling portmap which port it has been assigned. When a client wants to use that service, it first asks portmap on port 111 for the current port number, then connects to the service on whatever port portmap returns. Port 111 itself is the directory; the actual RPC services run elsewhere.
Modern Unix and Linux systems still ship with portmap or rpcbind running by default in many configurations, primarily because NFS continues to use it. Some Linux distributions have moved toward NFSv4, which can operate without portmap, but mixed environments and legacy infrastructure keep port 111 in active use.
Outbound port 111 from end-user devices is uncommon. Inbound port 111 from the public internet to any host is unusual and is generally treated as a configuration mistake.
About TCP Port 111
Port 111 is registered with the Internet Assigned Numbers Authority (IANA) for sunrpc. The IANA description reads: ‘SUN Remote Procedure Call’.
Security Considerations
Port 111 has a long-standing reputation as a reconnaissance target rather than a direct exploitation target. The portmap service is designed to answer questions about what RPC services a host is running, and that information is exactly what an attacker preparing to compromise a Unix system wants to know. Our data shows 63 IDS rules referencing port 111, and all of them share the same classtype: rpc-portmap-decode. Sample rules detect specific portmap queries asking about particular RPC services, including mountd (NFS mount daemon), statd (NFS file locking), rexd (remote execution daemon), pcnfsd (PC-NFS authentication), nisd (NIS directory service), cmsd (Calendar Manager Service), and others. Each of these target services has had its own history of vulnerabilities; portmap’s role is to tell an attacker which of them are running on the target.
The classic attack pattern is two steps. First, query port 111 to enumerate the RPC services available on the host. Second, attack the discovered services on whatever ports they are using, often exploiting vulnerabilities in mountd, statd, cmsd, or rpc.statd that were extensively documented in the late 1990s and early 2000s. Many of the underlying vulnerabilities have been patched for decades, but the portmap-based reconnaissance step remains useful against unpatched legacy systems.
Beyond the reconnaissance use case, portmap can also be abused as an amplification vector for distributed denial of service attacks: an attacker sends a small spoofed query to port 111 on a misconfigured server and the server returns a much larger response to the spoofed victim address. Several major DDoS amplification campaigns in the mid-2010s exploited misconfigured portmap services on the public internet.
Common practice today is to firewall port 111 from the public internet entirely, restrict it to specific internal network ranges where RPC services are genuinely needed, and run rpcbind (the modern portmap replacement) with the warning-flag and access-control features it supports. Where NFSv4 is available and portmap is not strictly required, configuring NFS to operate without rpcbind eliminates the exposure entirely.
Inbound port 111 from the public internet is unusual in 2026 and warrants investigation. Outbound port 111 from end-user devices is uncommon and may indicate unusual administrative activity or malware reconnaissance behavior.
IDS Rule References
31 IDS / security rules reference TCP port 111. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 1): rpc-portmap-decode (31).
Sample rule descriptions for TCP port 111:
- PROTOCOL-RPC portmap ypupdated request TCP
- PROTOCOL-RPC portmap snmpXdmi request TCP
- PROTOCOL-RPC portmap espd request TCP
- PROTOCOL-RPC portmap listing TCP 111
- PROTOCOL-RPC portmap admind request TCP
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry and Snort Community Rules (GPLv2).