STCP TCP/UDP Ports
As the number of TCP based applications released by Stratus grows it is becoming harder to keep track of all the port numbers that are being used. In some cases firewalls must be reconfigured to allow packets destined for those ports through. In other case firewalls should probably be configured to make sure that the packets do not get through. These tables will list the ports used by Stratus supported server and client applications as well as briefly describe them. Note that in many cases these port numbers can be changed by modifying a configuration file or via an argument on the command line. This article lists only the default port numbers.
These tables originally appeared in the July 2007 Stratus Customer eNewsletter. The tables appearing here have been updated with information about new applications released since then.
| Listening Port | TCP/UDP | Application | Protocol | Releases | Product Code |
| 7 | TCP/UDP | inetd | echo | All | Part of STCP/VOS |
| 9 | TCP/UDP | inetd | discard | All | Part of STCP/VOS |
| 13 | TCP/UDP | inetd | daytime | All | Part of STCP/VOS |
| 19 | TCP/UDP | inetd | chargen | All | Part of STCP/VOS |
| 21 | TCP | ftpd | FTP | All | Part of STCP/VOS |
| 22 | TCP | sshd | SSL/TLS | 14.7 and 15.1+ Not in 15.0 | S270 (OpenSSL and OpenSSH for VOS) |
| 23 | TCP | telnetd | telnet | All | Part of STCP/VOS |
| 24 | TCP | telnet_msd | telnet | All | Part of STCP/VOS |
| 37 | TCP/UDP | inetd | time | All | Part of STCP/VOS |
| 67 | UDP | inetd | bootp | All | Part of STCP/VOS |
| 69 | UDP | inetd | TFTP | All | Part of STCP/VOS |
| 80 | TCP | httpd | HTTP | 14.3 - 14.7 and 15.2+ not in 15.0 or 15.1 | S266 (Apache Web Server) |
| 85 | TCP | telnetd | telnet | 15.0+ | Part of STCP/VOS |
| 111 | UDP | portmapper | portmapper | All until 15.0 back in 15.1.1+ | S135 (NFS) S048 (VOS RPC and XDR) |
| 123 | UDP | ntpd | network time | 15.1+ | Part of STCP/VOS |
| 137 | UDP | nmbd | CIFS | 14.4+ | S269 (Samba 2.0, 3.0) |
| 138 | UDP | nmbd | CIFS | 14.4+ | S269 (Samba 2.0, 3.0) |
| 139 | TCP | smbd | CIFS | 14.4+ | S269 (Samba 2.0, 3.0) |
| 161 | UDP | snmpd | snmp | All | Part of STCP/VOS |
| 161 | UDP | snmpdm | snmp | 15.2+ | S684 (EMANATE for VOS) |
| 162 | UDP | traprcv | snmp | 15.2+ | S684 (EMANATE for VOS) |
| 443 | TCP | httpd | HTTP | 15.2.0+ | S266 (Apache Web Server) | 445 | TCP | smbd | CIFS | 15.1.0+ | S269 (samba 3.0) |
| 500 | UDP | iked | IKE | 16.1+ | S049 (IPSEC and IKE) |
| 901 | TCP | swat | HTTP | 14.4+ | S269 (Samba) |
| 2049 | UDP | nfs_server | RPC-NFS | All until 15.x | S135 (NFS) |
| 3XXX | TCP | VOS kernel | OSL | All | Part of STCP/VOS |
| 4XXX | TCP | VOS kernel | OSL | All | Part of STCP/VOS |
| 4500 | UDP | iked | IKE | 16.1+ | S049 (IPSEC and IKE) |
| 10000 | TCP | ndmpd | NDMP | 14.7+, 15.2x | S0683 (VOS Enterprise Backup Agent) |
| 29000 | UDP | sync_cfgd | bootp | 15.0+ | Part of STCP/VOS |
| Listening Port | Application |
| 7 | This is one of the so called tiny services. Its function is to echo back whatever data is sent to it. By default inetd will listen for this service. Prior to the posix version of inetd (VOS 14.5) inetd would start a process running the >system>stcp>command_library>echo_stream.pm application for TCP connections. UDP connections are handled internally by the pre-posix version of inetd. The posix version of inetd handles both TCP and UDP connections internally. Unless you have a specific reason to run echo I suggest that you add a comment character (#) to the beginning of the controlling line in inetd.conf. Under certain conditions this service could be used as part of a denial of service (DOS) attack. |
| 9 | This is another one of the tiny services. Its function is to act as a connection end point; any data sent to it is just discarded. By default inetd will listen for this service. Prior to the posix version of inetd (VOS 14.5) inetd would start a process running the >system>stcp>command_library>discard_stream.pm application for TCP connections. UDP connections are handled internally by the pre-posix version of inetd. The posix version of inetd handles both TCP and UDP connections internally. Unless you have a specific reason to run discard I suggest that you add a comment character (#) to the beginning of the controlling line in inetd.conf. |
| 13 | Yet another tiny service. Its function is to return the current date and time in human readable format and then close the connection. By default inetd will listen for this service. Both the pre-posix version and the posix versions of inetd handle this request (TCP or UDP) internally). Unless you have a specific reason to run daytime I suggest that you add a comment character (#) to the beginning of the controlling line in inetd.conf. Under certain conditions this service could be used as part of a denial of service (DOS) attack. |
| 19 | One more of the tiny services. Its function is to return a stream of (printable) characters. It will continue to send characters as fast as possible until either the connection is closed or the receiver's window closes. By default inetd will listen for this service. Prior to the posix version of inetd (VOS 14.5) inetd would start a process running the >system>stcp>command_library>chargen_stream.pm application for TCP connections. UDP connections are handled internally by the pre-posix version of inetd. The posix version of inetd handles both TCP and UDP connections internally. Unless you have a specific reason to run chargen I suggest that you add a comment character (#) to the beginning of the controlling line in inetd.conf. Under certain conditions this service could be used as part of a denial of service (DOS) attack |
| 21 | This is the well know port for the FTP daemon. Unlike TCP_OS the STCP FTP server (>system>stcp>command_library>ftpd.pm) is not started by inetd but is started as a separate process when STCP is started. |
| 22 | Secure Shell (>system>openssl>sbin>sshd.pm). This sets up an encrypted communication link between the end point and the module. It can be used for login or slave sessions, a secure FTP or for any application via ssh tunneling. The daemon is typically started by module_start_up.cm |
| 23 | This is the well known port for the Telnet daemon. Unlike TCP_OS the STCP telnet server (>system>stcp>command_library>telnet.pm) is not started by inetd but is started as a separate process when STCP is started. The telnet_admin command can be used to configure telnetd to listen to other ports as well or to not listen to port 23 but by default 23 is the only port that it will listen for. |
| 24 | The telnet_msd daemon (>system>stcp>command_library>telnet_msd.pm) also implements the telnet service but uses vterm devices instead of window_term devices. This service should only be used if you are running applications that make use of forms or do raw writes to the terminal device and still use the "old" terminal control opcodes. These applications do not display correctly on window_term devices and should be upgraded to use the new terminal control opcodes. The telnet_msd command includes the network_port argument that specifies the port number. Unlike TCP_OS the STCP version of telnet_msd is not started by inetd, but must be started as a separate process. It is not started by default by the start_stcp command macro. |
| 37 | This is the last tiny service. Its function is to return the current date and time in machine readable format and then close the connection. By default inetd will listen for this service. Both the pre-posix version and the posix versions of inetd handle this request (TCP or UDP) internally. Unless you have a specific reason to run time I suggest that you add a comment character (#) to the beginning of the controlling line in inetd.conf. Note that the NIO configuration requires that the module be running the TCP version of this service so that time stamps in NIO logs and VOS logs are synchronized. For modules with an NIO I recommend that the site firewall be configured to block any TCP time requests directed to the module. Since this service is handled internally by inetd you cannot use TCP Wrappers to restrict connects to only NIO servers. Unless you have a specific reason to run the time service I suggest that you add a comment character (#) to the beginning of the controlling UDP (and TCP if not running with an NIO) line in inetd.conf. |
| 67 | Client systems can use the bootp protocol to obtain IP addresses and boot images. It is similar to DHCP but not as flexible but it does use the same well known port. The inetd.conf file contains 2 lines that can be used to start this service. The first starts the service (>system>stcp>command_library>bootpd.pm) directly while the second passes the connection through the TCP Wrappers (tcpd) filter. By default both these lines are commented out. Unless you have an explicit need to start this service I recommend that you leave the comment characters in place. |
| 69 | The Trivial File Transfer Protocol (TFTP) is used to transfer files with a minimum of overhead. Like bootpd the inetd.conf file contains 2 lines that can be used to start this service. The first starts the service (>system>stcp>command_library>tftpd.pm) directly while the second passes the connection through the TCP Wrappers (tcpd) filter. By default both these lines are commented out. Unless you have an explicit need to start this service I recommend that you leave the comment characters in place. Note that the NIO configuration requires that the module be running the TFTP service so for modules with an NIO I recommend that the site firewall be configured to block any TFTP requests directed to the module. In addition I recommend that inetd be configured to start tftpd using the TCP Wrappers line and that tcpd be configured to allow only the NIO to use the TFTP service. |
| 80 | The Apache web server (>system>apache_install_dir>bin>httpd.pm) listens on this port. |
| 85 | Port 85 is listened to by the telnet server but is configured as an incoming slave device (rsn_incoming). As the name suggests this is for the RSN. Connections for this port should never come from a "corporate" or "production" intranet or internet or the Internet. I suggest that any firewalls be configured to block connections to this port. |
| 111 | The portmapper process (>system>rpc>stcp>command_library>portmap.pm) acts as "directory assistance" for RPC applications. RPC applications listen on a port number (or numbers) and register with the portmapper. When a client wishes to connect to an RPC application, it contacts the portmapper and asks it what port the application is listening on. There are no commands in module_start_up (commented out or otherwise) to start the portmapper process. If you want to start this process I recommend that you build a command macro to start this process and then add a call to the command macro to module_start_up.cm. |
| 123 | The network time protocol daemon (>system>command_library>ntpd.pm) is supported by VOS starting in release 15.1. It is used to keep the V-series clock synchronized with a time server. As such it acts as a client and must be able to contact an NTP server somewhere on the "net". It will also act as a server which is why it is listening on port 123. |
| 137 138 | These ports (137 NetBIOS Name Resolution and 138 NetBIOS Datagram) are handled by the NetBIOS Nameserver daemon (>system>samba>command_library>nmbd.pm) which part of the Samba product. Samba allows the module to act as a file server for Microsoft Windows systems and Unix systems running a smbclient process. The NetBIOS Nameserver daemon is started by the start_samba.cm (>system>samba>command_library>start_samba.cm). A call to this is typically placed in the module_start_up.cm. |
| 139 | The NetBIOS Session Service port is handled by the Samba Server daemon (>system>samba>command_library>smbd.pm). Samba allows the module to act as a file server for Microsoft Windows systems and Unix systems running an smbclient process. The Samba Server daemon is started by the start_samba.cm (>system>samba>command_library>start_samba.cm). A call to this is typically placed in the module_start_up.cm. |
| 161 | The Simple Network Management Protocol (SNMP) agent (>system>stcp>command_library>snmp.pm) that is part of STCP allows an SNMP manager to query the system and retrieve all the information that is part of the MIB II data structure (RFC-1213). Note that you cannot run both snmpd and snmpdm at the same time on the same module. |
| 161 | The Simple Network Management Protocol (SNMP) agent (>system>vsnmpmgr>emanate>objdir>vos.bin>snmpdm.pm) that is part of EMANATE for VOS product allows an SNMP manager to query the system and retrieve all the information that is part of the MIB II data structure (RFC-1213). In addition the product allows you to construct your own subagents to return other information about the system. Note that you cannot run both snmpd and snmpdm at the same time on the same module. |
| 162 | traprcv (>system>vsnmpmgr>emanate>objdir>vos.bin>traprcv.pm) is part of EMANATE for VOS product allows you to receive SNMP traps |
| 443 | The Apache web server (>system>apache_install_dir>bin>httpd.pm) listens on this port for SSL based connections. |
| 445 | Sometimes called Samba (CIFS) over TCP. Using this port skips the NetBIOS layer that is used with port 139. Since NetBIOS can also run over TCP the name "samba over TCP" is not accurate. |
| 500 | The iked server (>system>stcp>command_library>iked.pm) is used for key exchange when using IPSec. |
| 901 | Is a Samba configuration and status utility that can be access from any web browser. Inetd is configured to listen for this service and start >system>samba>command_library>swat.pm when a connection is made. |
| 2049 | The Network File System (NFS) (>system>rpc>stcp>command_library>nfs_server.pm) is a file sharing protocol based on RPC. Technically it can listen on any port since it registers with the portmapper and all NFS clients first query the portmapper to get the port number. However, it always binds to port 2049
Along with the NFS server there is a mount (mountd) server. Like the NFS server mountd registers with the portmapper so any port number can be used. Unlike the NFS server mountd does not always bind to the same port. |
| 3XXX | Open StrataLink (OSL) by default uses ports starting from 3000 and goes to 3XXX where XXX is 2 times the max_open_server number defined in the new_modules.tin file for the module. OSL is a file/device sharing protocol used between Stratus VOS modules defined in the same system. The OSL ports are handled by the kernel. |
| 4XXX | Open StrataNet (OSN) by default uses ports starting from 4000 and going to 4XXX where XXX is the max_open_server number defined in the new_backbone_systems.tin file for the module. OSN is a file sharing protocol used between Stratus VOS systems. Only bridge modules (1 per system) communicate over these ports. A non-bridge module in system A that wants to talk to a module in system B sends the request over OSL to system A's bridge module which them forwards it on to system B's bridge module which then passes it on to the target module. The OSN ports are handled by the kernel. |
| 4500 | The iked server is used for key exchange when using IPSec. It uses port 4500 when communicating with a remote host that is behind a NAT device. |
| 10000 | The VOS Enterprise Backup Agent based on the Network Data Management Protocol (>system>ndmpd>bin>ndmpd.pm) allows you to backup VOS files to (and restore from) an Enterprise Backup System (EBS) running on a non-VOS system. |
| 29000 | The sync_configd (>system>stcp>command_library>sync_cfgd.pm) server is a bootpd server but is design to ONLY handle requested from NIO blades that are purchased with the V-series. As such this will not appear on Continuum systems and should not be run on V-series modules without an NIO. In addition since all requests from the NIO will come over the private network that directly connects the NIO to the module any firewalls should be configured to drop connections to this port. |
Note: in the following tables, EP stands for Ephemeral port. This is a port number that is chosen by the system. Each connection will have a different port number. The value of these port numbers has no significant meaning.
| Source Port | Destination Port | TCP/UDP | Application | Protocol | Releases | Product Code |
| 20 | TCP | ftp_ch | FTP | All | Part of STCP/VOS | |
| EP | 22 | TCP | ssh, sftp, scp | SSL/TLS | 14.7 and 15.1+ Not in 15.0 | S270 (OpenSSL and OpenSSH for VOS) |
| EP | 53 | UDP | DNS | All | Part of STCP/VOS | |
| 123 | 123 | UDP | ntpd | Network Time | 15.1+ | Part of STCP/VOS |
| EP | 161 | UDP | snmp* | snmp | 15.0+ | Part of STCP/VOS |
| EP | 161 | UDP | get* | snmp | 15.2+ | S684 (EMANATE for VOS) |
| EP | 162 | UDP | trapsend | snmp | 15.2+ | S684 (EMANATE for VOS) |
| EP | 1414 | TCP | 13.0+ | S014 (MQSeries) | ||
| EP | 1812 | UDP | radius_auth_server | Radius | 14.4+ 15.0+ | S268 (Radius Support) Part of STCP/VOS |
| EP | 48879 | TCP | x25_cp | 15.0+ | Part of STCP/VOS | |
| 10000 - 65535 | TCP | Ephemeral Ports | Before 14.5.0at 14.6.0aj | Part of STCP/VOS | ||
| 49152 - 65535 | TCP | Ephemeral Ports | 14.5.0at+ 14.6.0aj+ 14.7+ | Part of STCP/VOS | ||
| 1024 - 65535 | UDP | Ephemeral Ports | Before 15.1.0ar | Part of STCP/VOS | ||
| 49152 - 65535 | UDP | Ephemeral Ports | 15.1.0ar+ 16+ | Part of STCP/VOS |
| Source Port | Dest Port | Application |
| 20 | ftp_ch (>system>stcp>command_library>ftpd_ch.pm) is the command for each FTP process created when an FTP connection is established. Data transfer packets (as opposed to control packets) are sent from port 20 to a port specified by the client. | |
| EP | 22 | The secure socket clients ssh.pm, sftp.pm, scp.pm can all be found in >system>openssl>bin. | EP | 53 | Domain Name Server queries can be initiated by any application that needs to resolve a host name to an IP address. | 123 | 123 | The network time protocol daemon (>system>command_library>ntpd.pm) is supported by VOS starting in release 15.1. It is used to keep the V-series clock from drifting to far. As such it acts as a client and must be able to contact an NTP server somewhere on the "net". It can also act as a server which is why it also is listening on port 123 (yes I copied this from table 2) | EP | 161 | The snmp* routines are all located in the >system>maint_library directory. They can be used to create and send SNMP protocol queries. These commands are undocumented but are ports of the net-snmp command set (see http://www.net-snmp.org). They also have extensive help that can be seen if you execute them with the -h argument. | EP | 161 | The get* routines are all located in the >system>vsnmpmgr>emanate>objdir>vos.bin directory. They can be used to create and send SNMP protocol queries. PDF files documenting the commands can be found in >system>vsnmpmgr>emanate>doc>user. | EP | 162 | The >system>vsnmpmgr>emanate>objdir>vos.bin>trapsend command can be used to create and send SNMP protocol traps. PDF files documenting the command can be found in >system>vsnmpmgr>emanate>doc>user. | EP | 1414 | mqseries does not have a specific client. The product is a collection of object modules that can be bound with an application client to allow it to communicate with an MQSeries server. | EP | 1812 | The radius client >system>command_library>radius_auth_server.pm will send a message to the radius server whenever someone tries to login and their registration information indicates "external password". | EP | 48879 | The x25_cpc PM (>system>command_library>x25_cpc.pm) is used to communicate with the NIO blades that handle X25. The X25 protocol is encapsulated into a TCP packet and transmitted to from the NIO to the Stratus where it is decapsulated and handled as ax X25 frame. |
Send comments and suggestions