# WHATPORT(900)

## NAME

port 900 — OMG Initial References (CORBA) — Registered to the Object Management Group for CORBA bootstrap references, and almost never actually used.

Protocol: TCP  
IANA: omginitialrefs

## DESCRIPTION

The IANA registration is omginitialrefs, from CORBA: an ORB could publish its initial object references — NameService, RootPOA and friends — at a fixed well-known port so a client could bootstrap without being handed a corbaloc URL. Real CORBA deployments configure their own ports, so 900 sits empty on essentially every host. Anything you find listening there today picked a round number for itself, usually an internal service or an admin web UI. nmap's frequency data puts 900 far down the list of ports found open, which matches that.

## EXPOSURE

**Expose with care.** No standard service runs here, so an open 900 is an unidentified listener — fingerprint it before deciding anything, and treat an unknown service on a public IP as a finding rather than a feature.

## CHECK

```sh
sudo lsof -nP -iTCP:900 -sTCP:LISTEN
```

## SEE ALSO

- iana — [IANA port registry — 900](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=900) (iana.org)
- docs — [OMG — CORBA specification](https://www.omg.org/spec/CORBA/) (omg.org)
- source — [nmap-services (900/tcp omginitialrefs)](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/900/> · JSON: <https://whatport.net/900.json> · full dataset: <https://whatport.net/ports.json>