Port 111 – RPC Portmapper / rpcbind

TCP/UDP

Port 111 is the ONC RPC portmapper (rpcbind). It maps RPC program numbers to dynamic TCP/UDP ports. Used by NFSv3, NIS, and other RPC-based services. Portmapper should be blocked at the firewall for any public-facing server – it exposes information about all registered RPC services and has been involved in DDoS amplification attacks.

Port Number

111

Protocol

TCP/UDP

Service

ONC RPC Portmapper

Range

IANA Well-Known (0–1023)

Description

The portmapper daemon rpcbind listens on port 111 and responds to queries about which ports other RPC services are using. NFSv3 requires portmapper to locate the mount daemon, NFS daemon, and NLM (lock manager). NFSv4 eliminated this dependency. UDP port 111 has been used in DDoS amplification attacks due to its large response relative to request size. Block port 111 on any internet-facing host.

Security risks

1DDoS amplification: rpcbind UDP responses can amplify requests by 20-28x. Publicly exposed port 111 is actively scanned and used in reflection attacks
2CVE-2017-8779: rpcbind memory corruption – remote attacker sends crafted RPC calls causing DoS via memory exhaustion (affects all Linux distros with rpcbind)
3Information disclosure: rpcinfo -p reveals all registered RPC services, their ports, and versions – valuable reconnaissance (shows NFS, NIS, NLM versions)
4NFSv3 dependency chain: blocking port 111 breaks NFSv3 mounts because clients query portmapper to find mountd and nfsd dynamic ports
5Legacy NIS (Network Information Service) on port 111: if NIS is running, portmapper reveals it, and NIS has no encryption (passwords, groups, hosts all in cleartext)

Firewall guidance

Block port 111 (both TCP and UDP) from the internet completely. If NFSv3 is needed internally, restrict to specific client subnets. Better: migrate to NFSv4 which eliminates the portmapper dependency entirely (uses only TCP 2049). If rpcbind must run, bind to localhost: edit /etc/sysconfig/rpcbind with RPCBIND_ARGS='-h 127.0.0.1'.

Diagnosis commands

List all registered RPC programs (shows what portmapper is advertising)

shell

rpcinfo -p localhost

Check if portmapper is reachable on target (should fail from internet)

shell

rpcinfo -T udp target 100000

Verify rpcbind binding (should be 127.0.0.1 or specific interface, not 0.0.0.0)

shell

ss -tulnp | grep 111

Check if rpcbind is running (disable if NFSv4 only)

shell

systemctl status rpcbind && systemctl stop rpcbind

Usage examples

Port 111 – RPC Portmapper / rpcbind

shell

rpcinfo -p localhost
nmap -sV -p 111 server

Common services on this port

rpcbindportmapperNFSv3 (requires portmapper)NIS/NIS+rstatdrusersd

Related ports

2049

NFS (main filesystem protocol)

20048

mountd (NFS mount daemon)

4045

lockd (NFS file locking)

875

rquotad (NFS quotas)

History

Portmapper was created by Sun Microsystems in the early 1980s as part of ONC RPC (RFC 1057). Port 111 was assigned by IANA. It acts as a directory service: RPC programs register their dynamic port numbers with portmapper, and clients query port 111 to find them. NFSv4 (2003) eliminated the need for portmapper by using only TCP 2049. Modern Linux uses rpcbind (replacing the original portmap daemon) which added support for IPv6.

FAQ

Can I disable rpcbind entirely?

Yes, IF: (1) you use NFSv4 exclusively (not NFSv3), (2) you don't run NIS, and (3) no legacy RPC services are needed. Disable with: systemctl disable --now rpcbind rpcbind.socket. Test NFS mounts still work (NFSv4 mounts directly on port 2049 without portmapper). AWS EFS uses NFSv4.1 and doesn't need rpcbind on the client.

Why is UDP port 111 dangerous?

UDP portmapper responds to queries without a TCP handshake, making it exploitable for amplified DDoS: attacker spoofs victim's IP in the source field, sends small query to port 111, server sends 20-28x larger response to the victim. Thousands of exposed portmappers combine into Gbps-scale attacks. Even if you need rpcbind, disable UDP: rpcbind -w (disable UDP listening) or block UDP 111 in iptables.