Port 113Identification Protocol
Port 113 was historically used for the Identification Protocol (Ident), a service that identifies the user of a particular TCP connection. This service allowed remote servers to query a client system to determine which user initiated a connection request, facilitating logging and access controls. While once commonly enabled on servers and network devices, Ident's use has declined substantially due to privacy concerns, inherent security risks, and the development of more secure authentication methods..
- transport
- tcp · udp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 12,055
2 transports registered
payload readable on path
registered with iana
caution
rank 325 of 993 · top 33%
1 other service is registered on port 113. compare all 2 →
Technical Details
what runs on :113The Identification Protocol (Ident), defined in RFC 1413, was designed to provide a means for servers to determine the identity of a user initiating a TCP connection. When a client connects to a server, the server may open a connection back to port 113 on the client to perform an Ident query. The client responds with the username associated with the connection's local endpoint. This was especially useful on multi-user systems, such as Unix servers and IRC clients, helping identify individual users on shared IP addresses.
The protocol operates in plain text, listening on TCP and UDP port 113. Requests are simple text queries containing the server- and client-side port numbers associated with the original connection. The responding host returns a response with system and user information. Due to its simplicity, Ident had minimal overhead but lacked any native encryption or authentication mechanisms.
While effective in early networking environments, the protocol gradually fell out of favor. Nowadays, most modern operating systems disable the Ident service by default, and firewalls typically block inbound connections on port 113. Alternative authentication frameworks, including more secure identity management and logging solutions, have better addressed the needs once fulfilled by Ident.
Security Information
exposure of :113risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 0.2 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities:
- Information Disclosure: Because responses often include system usernames, Ident can leak sensitive information useful to attackers performing reconnaissance.
- Spoofing and False Data: Without authentication, responses can be falsified, misleading relying services.
- Denial of Service (DoS): Identification queries can be abused to tie up system resources or facilitate DoS attacks by flooding the Ident service.
- Exploitation Points: Ident has minimal inherent security controls and trusts the client’s response, which can be easily manipulated or forged.
Mitigations:
- Disable the Service: Unless explicitly required, disabling Ident drastically reduces attack surface.
- Firewall Filtering: Block incoming connections to port 113 at network perimeters and host-based firewalls.
- Avoid Relying on Ident: Do not depend on Ident for access control or logging—use secure, authenticated identity solutions instead.
- Use Encrypted Authentication: Shift to protocols that provide encryption and strong authentication to protect user identities.
- Monitor Logs: Regularly analyze logs to detect unauthorized access attempts over port 113, if the service remains enabled.
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted