A 1988 service multiplexer: connect, send a service name, and the server hands you that service on the same socket.
TCPMUX lets a host offer many small services behind one port. A client connects to 1, sends a service name terminated by CRLF, and the server replies '+' or '-' before handing the connection to the named service. It shipped as an inetd built-in on several classic UNIX systems and is effectively extinct today. Anything answering on port 1 is either a deliberately exotic setup or a scanner artifact, and the port is a routine early entry in mass port sweeps.
Do not expose
By design it is a directory that dispatches into other local services, so exposing it exposes whatever is registered behind it.
$ sudo lsof -nP -iTCP:1 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.