Port 1TCPMUX
The TCP Port Service Multiplexer (TCPMUX) is a protocol used on port 1 to allow clients to query a server for a list of active services and connect to specific daemon processes dynamically. It acts as a service directory or initial contact point, facilitating connection establishment to various services hosted on a server..
- transport
- tcp · udp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 12,881
2 transports registered
payload readable on path
registered with iana
caution
rank 297 of 993 · top 30%
Technical Details
what runs on :1Overview:
TCPMUX, operating on port 1, is designed to act as a central point for accessing multiple services on a host using a common entry port. When a client connects, it sends the name of the desired service, and the multiplexer either forwards the connection or responds with a service list. This eliminates the need for each service to have a separate port, simplifying initial client connections.
Operation:
After establishing a TCP or UDP connection to port 1, the client transmits the service name followed by a carriage return and line feed sequence (CRLF). The multiplexer will then either forward this connection to the appropriate daemon/service or respond with a ‘+’ or ‘-’ indicating acceptance or denial. Services can be discovered by sending a special ‘help’ request, which prompts a list of hosted services.
Usage History and Prevalence:
Despite its design as a universal access point, TCPMUX has seen little adoption in modern systems due to security risks, ease of port-based service management, and the preference for dedicated well-known ports. Most contemporary servers disable this port by default to limit exposure. Some legacy or embedded systems may still implement it, yet it is largely obsolete.
Security Information
exposure of :1risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 0.2 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities:
- Information Disclosure: TCPMUX may reveal a list of active services, assisting adversaries in reconnaissance.
- Unauthorized Access: Poorly configured or unprotected multiplexers can allow attackers to access underlying services.
- Abuse for Bypass: Attackers may exploit multiplexing to bypass firewalls or ACLs set on other ports.
Mitigations:
- Disable TCPMUX: The strongest mitigation is to disable the service entirely if not explicitly required.
- Access Controls: Use network ACLs and host-based firewalls to restrict access to port 1.
- Service Restrictions: Configure the multiplexer to limit or authenticate service listings and access.
- Monitoring: Log and audit connection attempts to detect reconnaissance or misuse.
- Patch Regularly: Ensure underlying software and services are up-to-date to prevent exploitation of known vulnerabilities.
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted