Registered to the Viral Computing Environment; in real deployments it is Red Hat's ricci cluster agent, or a hand-picked repdigit port.
IANA assigns 11111 on TCP and UDP to vce, the Viral Computing Environment, an old distributed-computing research project of Fred Cohen's that you will not meet on a modern network. It is widely reported as the port of ricci, the node-side agent of Red Hat's long-retired luci/ricci cluster management stack, which the luci console used to manage cluster nodes; no current vendor documentation covers it, so treat that as received wisdom rather than a specification. Beyond that, 11111 is one of the repdigit numbers people reach for when they need an arbitrary port for a proxy, a test listener, or a container mapping, so a match here often means nothing more than someone typed five ones.
Do not expose
If it is ricci, it is a node-configuration channel for a cluster — management network only. If it is an ad-hoc listener, you still do not know what it is until you fingerprint it.
$ nmap -Pn -sV -p 11111 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.