Port 79Finger Protocol
The Finger Protocol is a legacy network service designed to provide information about users on a remote system. It allows clients to retrieve details such as usernames, full names, login time, and idle status. Originally created in the early days of the internet, it facilitated social interaction and user lookup across UNIX networked hosts..
- transport
- tcp
- in transit
- cleartext
- assignment
- official
- risk
- 4/10
- lookups
- 5,582
single transport
payload readable on path
registered with iana
caution
rank 871 of 993 · top 88%
Technical Details
what runs on :79The Finger Protocol, standardized in RFC 742 and later updated by RFC 1288, operates primarily over TCP port 79. A client initiates a connection to the Finger daemon (fingerd) on a remote machine and sends a query string, typically a username or left blank to receive information about all logged-in users. The server responds with user details stored in the system files, such as .plan, .project, and login details.
Initially designed for simplicity, the protocol does not require authentication or session management. Its command format is plain text, making it extremely lightweight. Despite its age, the protocol remains well-understood and trivial to implement, though obsolete in most production systems today due to privacy and security concerns.
Historically, its biggest appeal was social — users could publish status updates via .plan files or check the presence of collaborators remotely. This predates modern social networks and messaging systems, highlighting its role in early networked communication.
Security Information
exposure of :79risk score
4/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
network services averages 3.9 across 604 ports — this one sits 0.1 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp
every listening transport is another surface to filter at the edge
security overview
The Finger Protocol has multiple security vulnerabilities:
- Information Disclosure: It exposes sensitive details about users, providing invaluable data to attackers performing reconnaissance.
- Enumeration Attacks: Attackers can enumerate valid usernames on a system, facilitating targeted brute force or phishing attacks.
- Buffer Overflow Risks: Early
fingerdimplementations had buffer overflow vulnerabilities, enabling remote code execution. - Reflection / Amplification: Though uncommon, poorly configured finger services might be abused in certain network attacks.
Mitigations include:
- Fully disabling the finger service, which is highly recommended.
- Filtering inbound and outbound traffic on TCP port 79 at firewalls.
- Implementing strict user privacy policies, ensuring no sensitive data is exposed through
.planor.projectfiles. - Keeping system software up-to-date to mitigate residual vulnerabilities.
- Employing modern authentication and access control mechanisms, rather than relying on a legacy plaintext query service.
Related Ports
the 8 most looked-up other ports in network services — 604 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :9080 | Groove RPC | TCPUDP | Web Services | caution | 70.8k |
| :6543 | Jetnet | UDP | Network Services | caution | 65.3k |
| :5938 | TeamViewer | TCPUDP | Remote Access | caution | 65.0k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3233 | WhiskerControl Protocol | TCPUDP | Network Services | caution | 61.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Tatsoft Default HTTP Proxy | TCP | Web Services | caution | 46.8k |
risk mix of the 8 listed
- caution100%
0 of 8 encrypted