# WHATPORT(1)

## NAME

port 1 — TCPMUX — A 1988 service multiplexer: connect, send a service name, and the server hands you that service on the same socket.

Protocol: TCP  
IANA registry

## DESCRIPTION

TCPMUX lets a host offer many small services behind one port. A client connects to 1, sends a service name terminated by CRLF, and the server replies '+' or '-' before handing the connection to the named service. It shipped as an inetd built-in on several classic UNIX systems and is effectively extinct today. Anything answering on port 1 is either a deliberately exotic setup or a scanner artifact, and the port is a routine early entry in mass port sweeps.

## EXPOSURE

**Do not expose.** By design it is a directory that dispatches into other local services, so exposing it exposes whatever is registered behind it.

## CHECK

```sh
sudo lsof -nP -iTCP:1 -sTCP:LISTEN
```

## SEE ALSO

- spec — [RFC 1078 — TCP Port Service Multiplexer (TCPMUX)](https://www.rfc-editor.org/rfc/rfc1078.html) (rfc-editor.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/1/> · JSON: <https://whatport.net/1.json> · full dataset: <https://whatport.net/ports.json>