Port 512comsat & biff
The Comsat service, working alongside the `biff` notification utility, provides users with real-time notifications of new email arrivals on UNIX systems. It leverages UDP to listen for incoming mail notifications and alerts logged-in users when new messages are received, historically enabling immediate awareness of incoming communications..
- transport
- udp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 7,384
single transport
payload readable on path
registered with iana
caution
rank 691 of 993 · top 70%
1 other service is registered on port 512. compare all 2 →
Technical Details
what runs on :512The Comsat (COMmunications SATellite) daemon is a legacy UNIX system service that collaborates with the biff utility to notify logged-in users of new incoming mail. Operating over UDP port 512, it receives mail arrival notifications from the mail transfer agent (MTA) such as Sendmail when new mail is delivered. When the biff service is enabled on a user's session, Comsat locates the user's terminal device and displays a brief snippet of the new message header directly on the terminal screen.
Designed primarily for local mail delivery systems, Comsat is invoked by the MTA via the network, quickly and with minimal overhead due to its use of UDP. The notifications are simple, unauthenticated packets sent to the Comsat daemon on the localhost, which in turn looks up session details to notify the appropriate user.
With the evolution of mail access protocols like IMAP and POP3, coupled with graphical mail clients and push notification mechanisms, Comsat has largely become obsolete. However, it remains available on many UNIX systems for legacy support and historical completeness.
Security Information
exposure of :512risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
email averages 3.9 across 42 ports — this one sits 0.1 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities:
- Because Comsat does not implement any encryption or authentication, it is vulnerable to spoofed notification packets, enabling attackers to inject misleading or disruptive messages onto users’ terminals.
- Its use of UDP makes it susceptible to IP spoofing, denial of service, or potential reflection/amplification attacks.
- As a legacy exposed service, it can increase an attack surface unnecessarily if enabled without a valid operational need.
Mitigations:
- Disable the Comsat service unless explicitly required, to reduce security risks.
- Restrict UDP port 512 via firewalls or access control lists to only trusted local services.
- Enforce strict network segmentation and block external UDP packets targeting this port on perimeter devices.
- Use modern, authenticated notification methods where possible to replace legacy mechanisms.
- Regularly review and audit services listening on legacy ports to ensure they fit current security policies.
Related Ports
the 8 most looked-up other ports in email — 42 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :143 | IMAP | TCPUDP | caution | 20.7k | |
| :995 | POP3S | TCPtls | caution | 18.8k | |
| :109 | POP2 | TCP | caution | 17.9k | |
| :2096 | cPanel SSL Webmail | TCPtls | Web Services | safe | 17.4k |
| :110 | POP3 | TCP | caution | 15.5k | |
| :993 | IMAPS | TCPtls | caution | 14.5k | |
| :1352 | Lotus Notes RPC | TCP | caution | 12.3k | |
| :24 | Private Mail | TCPUDP | caution | 11.7k |
risk mix of the 8 listed
- safe13%
- caution88%
3 of 8 encrypted