Port 111 (rpcbind / portmapper)

ONC RPC port mapper, needed by NFSv3, NIS and other Sun RPC services.

Well-known (system) port, 0-1023 TCPUDP Network infrastructure Do not expose to the internet

What port 111 is used for

ONC RPC port mapper, needed by NFSv3, NIS and other Sun RPC services.

Do not expose to the internet. Block at the perimeter: it lists the RPC services on the host and has been abused for UDP amplification.

Service nameProtoDescriptionAssigneeReference

sunrpc TCP SUN Remote Procedure Call Chuck McManis -

sunrpc UDP SUN Remote Procedure Call Chuck McManis -

Linux: is anything listening on TCP 111?

sudo ss -tlnp 'sport = :111'

Linux: UDP 111

sudo ss -ulnp 'sport = :111'

Linux / macOS: which process owns the port

sudo lsof -nP -i :111

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':111 '

Windows (Command Prompt)

netstat -ano | findstr :111

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 111 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 111

From Windows

Test-NetConnection HOST -Port 111

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 111

ufw

sudo ufw deny 111/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 111 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 111 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 111' -Direction Inbound -Protocol TCP -LocalPort 111 -Action Block

ufw

sudo ufw deny 111/udp

iptables

sudo iptables -A INPUT -p udp --dport 111 -j DROP

nftables

sudo nft add rule inet filter input udp dport 111 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block UDP 111' -Direction Inbound -Protocol UDP -LocalPort 111 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.