Why is port 111 listening for incoming connections from any IP?

[hijax]

I downloaded the latest Kali VM for VMWare from OffSec and ran netstat -auntp to check for listening ports when I noticed that both port 111 was listening for incoming connections. I wanted to verify is this is normal since it feels odd to have rpcbind actively accepting connections. Would love feedback on this. Here's the output:



root@kali:~# netstat -auntp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/init
tcp6 0 0 :::111 :::* LISTEN 1/init
udp 0 0 0.0.0.0:68 0.0.0.0:* 641/dhclient
udp 0 0 0.0.0.0:111 0.0.0.0:* 1/init
udp6 0 0 :::111

root@kali:~# lsof -i -P -n | grep LISTEN
systemd 1 root 30u IPv4 14897 0t0 TCP *:111 (LISTEN)
systemd 1 root 32u IPv6 14901 0t0 TCP *:111 (LISTEN)

[bigbiz]

Did you google what this port is used for? A unix/linux os mapping port.

[hijax]

Yes I did but the question I have is why it's listening for incoming connections from any IP.

[bigbiz]

My guess you scanned a network and for some reason the service kept running. Used dsploit for instance

[Mister_X]

It's one of the systemd services. This is kinda confusing, systemd assumes the port.

List the services and figure out what services are running, then see if they have any port.

grep 111 /etc/services
It will show RPC, and there is a rpc service.
systemctl stop rpcbind.socket

[hijax]

It's one of the systemd services. This is kinda confusing, systemd assumes the port.

List the services and figure out what services are running, then see if they have any port.

grep 111 /etc/services
It will show RPC, and there is a rpc service.
systemctl stop rpcbind.socket

Thank you @Mister_X. Yeah I had already done that & stopped the service so thank you for the confirmation. My main concern is checking to see if it was necessary to have it running. I haven't seen any issues since disabling rpcbind yet.