Port 105CCSO Nameserver
CCSO Nameserver Protocol, also known as Qi or Ph, is a directory and query service developed for managing information within large-scale academic institutions. It allows clients to query a central database to retrieve user contact details and other institutional directory information. Despite its decline in popularity, some legacy systems may continue to utilize it for internal lookup services..
- transport
- tcp · udp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 6,475
2 transports registered
payload readable on path
registered with iana
caution
rank 781 of 993 · top 79%
Technical Details
what runs on :105The CCSO Nameserver Protocol—implemented primarily as Qi on the server side and Ph on the client side—was historically used by academic organizations, such as the University of Illinois, to provide a centralized directory service. Running typically on port 105, it enables searching, retrieval, and management of entity information like email addresses, phone numbers, and departmental info.
From a protocol perspective, Qi functions as a plaintext, query-response system. Client requests are sent via TCP or UDP, and contain formatted queries, which the server then processes before returning relevant records. The communication is straightforward but extensible, allowing both simple searches (e.g., by name) and more complex queries.
While once a common campus infrastructure service, Qi/Ph has been largely supplanted by more modern directories such as LDAP and DNS-based services, owing to their richer feature sets, standardization, and security improvements. Still, understanding the protocol is useful when dealing with legacy network environments or during network reconnaissance.
Security Information
exposure of :105risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
network services averages 3.9 across 604 ports — this one sits 0.1 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common vulnerabilities:
- The protocol transmits data in plaintext without encryption, risking exposure of sensitive user or institutional information during transit.
- Lack of built-in authentication or access controls may allow unauthorized queries, leading to data harvesting or directory enumeration.
- Its simplicity can make it susceptible to input fuzzing, malformed queries, or denial-of-service attacks.
Mitigations:
- Disable or restrict external access using firewall policies to limit exposure only to trusted internal clients.
- Employ network segmentation and VLANs to isolate systems running Qi/Ph.
- Upgrade to secure directory protocols such as LDAP over TLS.
- Monitor network traffic for unusual queries or scanning behavior targeting port 105.
- Deprecate legacy services, migrating data to modern, secure directory platforms.
Related Ports
the 8 most looked-up other ports in network services — 604 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :9080 | Groove RPC | TCPUDP | Web Services | caution | 70.8k |
| :6543 | Jetnet | UDP | Network Services | caution | 65.3k |
| :5938 | TeamViewer | TCPUDP | Remote Access | caution | 65.0k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3233 | WhiskerControl Protocol | TCPUDP | Network Services | caution | 61.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Tatsoft Default HTTP Proxy | TCP | Web Services | caution | 46.8k |
risk mix of the 8 listed
- caution100%
0 of 8 encrypted