Skip to main content
IMMUNITYSEC

Port 111: ONC RPC portmapper (rpcbind)

Port 111 hosts rpcbind, also called the portmapper, which maps ONC RPC program numbers to the network addresses where those programs listen. RFC 1833 states that all versions of this lookup service use port 111 over TCP and UDP. NFS and other RPC services register with it, although RFC 7530 notes that NFSv4 on its registered port 2049 lets clients skip the RPC binding step.

111
TCP / UDP

Port Details

Port
111
Transport
TCP / UDP
Service
rpcbind
IANA service name
sunrpc
Range
System port (0-1023)
Related ports
2049

Security Exposure

RFC 1833 defines a DUMP procedure that lists every entry in the rpcbind database, so an exposed port 111 reveals which RPC services, such as NFS, a host runs. CISA alert TA14-017A lists Portmap (RPCbind) as a UDP reflection vector with a bandwidth amplification factor of 7 to 28, after attacks using spoofed portmap requests were reported in 2015.

Hardening

  • +Block TCP and UDP 111 at the internet edge so the host cannot be used as a reflection amplifier, and allow it only from hosts that need RPC services.
  • +Disable rpcbind on systems that run no ONC RPC services.
  • +Use NFSv4 on port 2049 where possible so clients do not depend on rpcbind.

Monitoring

Alert on rpcbind queries from external addresses and on high volumes of UDP 111 responses to a single destination, a pattern consistent with reflection abuse.

Tools for Auditing and Monitoring rpcbind

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Suricata

Open Source
Network Monitoring Tools

High-speed network intrusion detection, prevention, and security monitoring engine with deep protocol parsing capabilities.

LicenseGPL-2.0-only
PlatformLinux, FreeBSD, macOS, Windows

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

What is port 111 used for?→

Port 111 is used by rpcbind (portmapper), which tells ONC RPC clients which address and port a given RPC program uses (RFC 1833). Services such as NFS register with it.

Is port 111 TCP or UDP?→

Both. RFC 1833 assigns port 111 to the RPC lookup service over TCP and UDP.

Should port 111 be open to the internet?→

No. CISA lists portmap among UDP services abused for DDoS reflection and recommends denying internet access to such services.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 111 is not guaranteed to be rpcbind. Exploited-in-the-wild data from the CISA KEV catalog (CC0).