Port 513Who Service
The WHO service on UDP port 513 is a legacy Unix command networking service designed to remotely return information about users logged into a host system. Often bundled with early UNIX systems, it provides details such as usernames, terminal locations, and login times. Due to its age and security concerns, its usage has largely declined with modern alternatives offering enhanced security..
- transport
- udp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 8,058
single transport
payload readable on path
registered with iana
caution
rank 629 of 993 · top 63%
1 other service is registered on port 513. compare all 2 →
Technical Details
what runs on :513-
The WHO service on port 513 uses UDP to facilitate quick and simple retrieval of currently logged-in users on a remote Unix server. This command-line utility (
who) queries the remote daemon which responds with session details. -
Historically, it formed part of a suite of remote management and information services on UNIX systems alongside others like
rwhoandfinger. WHO is a stateless protocol relying on UDP's connectionless delivery, making it lightweight but inherently unreliable. -
The output typically includes details such as usernames, terminals, hostnames, and login timestamps. Due to the simplicity of the protocol and typical lack of authentication or encryption, it is now largely obsolete, replaced by secure alternatives (such as SSH) or disabled by default.
Security Information
exposure of :513risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 0.2 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities:
- Lack of authentication exposes sensitive user session information to any requester.
- Plaintext UDP communication can be easily intercepted for reconnaissance.
- May aid attackers' enumeration phase by revealing active users and potential targets.
- Historical vulnerabilities in related UNIX services have resulted in buffer overflows and remote code execution.
Common Mitigations:
- Disable the WHO service if not explicitly required.
- Restrict UDP port 513 via firewall rules to trusted hosts only.
- Replace with secured protocols like SSH for remote management.
- Employ network monitoring to detect reconnaissance activities.
- Keep systems updated to mitigate related services vulnerabilities.
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted