Internet-Security raven logo internet-security.com

UDP 111

ProtocolUDP
Port111
Labelssunrpc portmapper, RPC 4.0 portmapper

Synopsis

  • UDP port 111 is used by the ONC RPC portmapper service (rpcbind/portmap) on Unix-like systems, including Linux (rpcbind package), FreeBSD, and Oracle Solaris.
  • Network File System (NFS) v2/v3 relies on rpcbind over UDP 111 to discover service ports like mountd, nlockmgr, rquotad; real implementations include Linux nfs-utils/nfsd, FreeBSD nfsd, and NAS platforms such as NetApp ONTAP and Dell EMC Isilon/PowerScale.
  • VMware ESXi hosts mounting NFSv3 datastores require connectivity to UDP/TCP 111 on the NFS server for rpcbind service discovery.
  • Legacy NIS/YP (ypserv/ypbind) uses rpcbind on UDP 111 to register and locate RPC services on systems such as Solaris and older Linux distributions.
  • The NFS lock/status components (rpc.statd/NSM) register with rpcbind, and clients use UDP 111 to learn their dynamic ports.
  • Security note: UDP 111 (rpcbind) has been abused for RPC reflection/amplification DDoS and for RPC/NFS service enumeration; exposed or misconfigured NFS via rpcbind has led to unauthorized data access.

Observed activity

Last 30 days Detailed chart

More information