{
  "port": 111,
  "protocol": "both",
  "service": "sunrpc / rpcbind (portmapper)",
  "oneLiner": "The ONC RPC portmapper — ask it which port a given RPC program is on, and it tells you.",
  "whatItIs": "rpcbind (formerly portmap) maps ONC RPC program numbers to the ports their servers actually listen on, per RFC 1833. NFS, `mountd`, `statd`, NIS, and quota daemons register with it at startup, and clients query 111 first to find them — which is exactly what `rpcinfo -p` does. It is on by default on most Linux and Solaris NFS servers and answers on both TCP and UDP. Its UDP side has been abused as a DDoS reflector, and its dump reply is a free inventory of a host's RPC services.",
  "exposure": {
    "verdict": "never",
    "note": "An internet-facing rpcbind enumerates your RPC services to anyone and its UDP listener is a known amplification reflector. Keep it on the internal network."
  },
  "checkCommand": "rpcinfo -p TARGET",
  "links": [
    {
      "title": "RFC 1833 — Binding Protocols for ONC RPC Version 2",
      "url": "https://www.rfc-editor.org/rfc/rfc1833.html",
      "kind": "spec"
    },
    {
      "title": "rpcbind(8) manual page",
      "url": "https://man7.org/linux/man-pages/man8/rpcbind.8.html",
      "kind": "official-docs"
    },
    {
      "title": "RFC 4506 — XDR: External Data Representation Standard",
      "url": "https://www.rfc-editor.org/rfc/rfc4506.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}