What program is using port 111?

[Mark Tunnell]

Ethereal and Netstat show a listener on port 111. I know this is the portmap port and I'd hoped to use lsof to show which program was utilizing this but lsof -i shows nothing on port 111. I've also tried lsof -i +M but still nothing on 111.

What am I missing?

Mark

[Caesar_3]

Hello!

Try to connect to that port and see if it will
let you know who is listening
telnet locahost 111

Caesar

[PIYUSH D. PATEL]

Hi Mark,

Some info about Port 111. Hope this helps.

There are many know exploits against a large list of services that the portmapper provides access to. All RPC services register themselves at port 111 (the "portmapper" or rpcbind for the Solaris guys). The calling client will have to access port 111 to query and identify ports where the needed service is running and ultimately connect to the service. This can be done with both TCP and UDP.

So the point is that port 111 is a place to find out where services are running. Many vulnerabilities exist with this port. For example, NFS has a known rpc-update exploit. Also, the NIS update daemon, rpc.ypupdated, contains vulnerabilities in how it passes commands to certain function calls.

Piyush

[James R. Ferguson]

Hi Mark:

Try sampling both TCP and UDP:

# lsof -i tcp:111
# lsof -i udp:111

Regards!

...JRF...

[Mark Tunnell]

up2:/ # netstat -an | grep 111
tcp 0 0 *.111 *.* LISTEN
udp 0 0 *.111 *.*
up2:/ #

lup2:/ # lsof -i tcp:111
lup2:/ # lsof -i udp:111

Still nothing. Telnet'ing to port 111 just hangs. Does anyone know what default HP-UX services listen on that port? I'm running 11.11.

Thanks,

Mark

[Kevin Wright · Accepted solution]

As everyone mentioned, rpcbind listens on that port. Try a rpcinfo -p hostname to see what processes are registered with the portmapper, if that is what you mean.

Otherwise, stop the rpcbind process if you don't want it running.

[Mark Tunnell]

Thanks. I'm not sure what it's telling me.

lup2:/etc/rc.config.d # rpcinfo -p localhost
program vers proto port service
100000 4 tcp 111 rpcbind
100000 3 tcp 111 rpcbind
100000 2 tcp 111 rpcbind
100000 4 udp 111 rpcbind
100000 3 udp 111 rpcbind
100000 2 udp 111 rpcbind
lup2:/etc/rc.config.d #

Does this mean that rpcbind has no portmap services registered? If that's the case and I don't need it how do I stop rpcbind from starting at boot? There's nothing by that name in /etc/rc.config.d.

Mark

[Con O'Kelly]

Hi Mark

Just to clarify rpcbind listens on port 111. Portmap is the old name for rpcbind and was used prior to 11.x.

The rpcinfo is showing you have no other rpc services registered with rpcbind.

rpcbind is started by the /sbin/init.d/nfs.core script.

To stop:
# /sbin/init.d/nfs.core stop.

To stop it starting at boot, update the /etc/rc.config.d/nfsconf file so that
NFS_CLIENT=0
NFS_SERVER=0

Cheers
Con