# WHATPORT(2106)

## NAME

port 2106 — MZAP / ekshell — MZAP's multicast scope announcements on UDP; historically Kerberos encrypted rshell on TCP.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

RFC 2776 defines the Multicast-Scope Zone Announcement Protocol here: routers on a scope boundary send Zone Announcement Messages to UDP 2106 at the local-scope group 239.255.255.252 so hosts can discover administrative scope zones and operators can spot misconfigured boundaries. That traffic is multicast infrastructure, not something a host offers. Unix /etc/services and Nmap also list ekshell on TCP 2106, the encrypted Kerberos remote-shell counterpart to eklogin, which MIT moved out of krb5 along with the rest of the Kerberized applications.

## EXPOSURE

**Expose with care.** MZAP is scoped multicast that is not meant to cross a zone boundary at all. A TCP listener here is something else — historically a Kerberized rshell daemon — and should be identified and kept internal.

## CHECK

```sh
sudo tcpdump -ni any udp port 2106
```

## SEE ALSO

- spec — [RFC 2776 — Multicast-Scope Zone Announcement Protocol (MZAP)](https://www.rfc-editor.org/rfc/rfc2776.html) (rfc-editor.org)
- source — [krb5-appl — the Kerberized telnet/rlogin/ftp applications split out of MIT krb5](https://github.com/krb5/krb5-appl) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/2106/> · JSON: <https://whatport.net/2106.json> · full dataset: <https://whatport.net/ports.json>