Port 111 rpcbind: Risks, Attacks and How to Secure It

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 9 November 2026.

In one sentence: Port 111 is the reception desk for a group of older Linux and Unix network services, and it should never be reachable from the internet.

What runs on this port

The service is called rpcbind (older systems call it portmap). It listens on port 111, over both TCP and UDP. Its job is to tell a caller which port a given remote procedure call (RPC) service is using. Red Hat describes it as a directory service for SunRPC-based services such as NFS.

The most common reason it is switched on is NFS, the Unix file-sharing system. A client asks rpcbind where the NFS service lives, then talks to that service directly. Other RPC services register here too.

Why attackers look for it

Internet-wide scanners and device search engines record which addresses answer on port 111. An open answer tells an attacker three things: the machine is probably Linux or Unix, it may share files, and nobody has put a firewall rule in front of it. That makes it a cheap way to build a target list. The service can also be asked to list the other RPC services registered on the host. That list shows what else is running and where.

How it gets attacked

Information gathering. The directory can be queried by anyone who can reach it. It reveals which services and versions are registered.
Denial of service. CVE-2017-8779, nicknamed “rpcbomb”, affected rpcbind, libtirpc and NTIRPC. The NVD text says these do not consider the maximum RPC data size during memory allocation for XDR strings, so a crafted UDP packet to port 111 could make the service eat memory. Red Hat rated it Important and explained that up to 4GiB per message could be allocated. Persistent attacks could make the system swap and the service be killed.
Stepping stone to NFS. If rpcbind is exposed, the NFS service behind it is often exposed too. Red Hat warns that with older NFS authentication, a malicious or misconfigured client can easily get this wrong. See the NFS entry.
Old versions. Fixes for rpcbomb were shipped as vendor updates. A server that was never patched stays open to it.

Who it affects and how badly

Small business (sole trader to 10 staff). Rare, but it appears on a NAS or a Linux file server someone set up years ago. Worst case: the box slows to a crawl or the file share is read by the wrong person.
Mid-sized business (50 to 250). Common on research, design, manufacturing and media file servers, and on Linux hosts run by an MSP. Worst case: a stalled file server stops the whole office working.
Regulated business (fintech, healthcare, legal). An exposed RPC service is a finding in any audit. If client data sits on the share, the ICO (UK), a supervisory authority (EU) or the Central Bank of Armenia may ask why it was open.

What we check on a test

Whether port 111 answers over TCP and UDP from the internet, and from the guest wifi or other network segments.
Which RPC services are registered, so we can see whether NFS, mountd or others are reachable.
The software versions, to compare against known fixes.
Whether the firewall rule exists because someone needed it, or because nobody removed it.

The UK angle

The NCSC’s Cyber Essentials requirements say the aim of the firewall control is to make sure that only secure and necessary network services can be accessed from the internet. They also require you to block unauthenticated inbound connections by default and to remove unneeded rules. An open port 111 on an internet-facing host fails that test in plain terms.

Diagram: why 111 matters

How to check whether yours is exposed

Look at your firewall or router rules for TCP or UDP 111, inbound from the internet. There should be none.
Check your own asset list for any Linux file server, NAS or backup appliance that offers NFS.
On a Linux host you own, list listening sockets (for example with ss -tulpn) and look for rpcbind.
Run the free scan to see what your public address shows. Only check addresses you own or have permission to test.

How to secure it

Block TCP and UDP 111 at the internet firewall. Red Hat’s advice is to close port 111 on machines which are on a public or untrusted network, and to allow trusted machines only where it must stay open.
If you do not use NFS, stop and disable rpcbind and the NFS services.
Where you do use NFS, restrict rpcbind with firewall rules or TCP wrappers, as the Red Hat storage guide describes.
Apply vendor updates for rpcbind and libtirpc. Red Hat names fixed errata for RHEL 6 and 7.
Keep the check on a schedule. CISA’s guide says to conduct regular vulnerability scanning on internet-facing devices.
Monitor the memory use of rpcbind. Red Hat suggests a simple job that watches its VmSize and raises an alert.

FAQ

Is port 111 dangerous? Not by itself. It becomes a problem when it faces the internet, because it reveals services and has had a denial-of-service flaw (CVE-2017-8779).

Do I need port 111 open for NFS? Only between your own trusted machines. It should not be open to the internet.

What is rpcbomb? The nickname for CVE-2017-8779, a memory-use flaw in rpcbind and related libraries that vendors have fixed with updates.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. See our penetration testing service and start with the free web vulnerability scan.

Port 111 (RPCbind): what it is, how it is attacked and how to secure it