Skip to content
ProtocolPorts

Port reference

Port 113 (TCP) – Ident / Auth

Identification protocol that reports the username owning a given TCP connection.

tcpWell-known

Quick facts

Transport
tcp
Category
Well-known
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Largely disabled today but historically queried by IRC, mail, and FTP servers; identd still appears on legacy Unix.

What is port 113 used for?

Port 113 runs the Ident protocol (RFC 1413), also called Auth. When your computer opens an outbound connection, the remote server can ask port 113 on your machine which local username owns that connection. It was widely used by IRC, mail (SMTP), and FTP servers to log or check the identity behind a session. Modern systems rarely run identd, but it still turns up on legacy Unix.

When would you open it?

You'd run identd only if you operate a multi-user shell or IRC server where remote services expect ident lookups. On most machines there's no need; if anything, you configure the firewall so probes from IRC/mail servers get a fast refusal instead of hanging.

Is it safe to open?

Ident reveals the username behind each connection and the answer is easy to fake, so it leaks information without providing real authentication; it's usually best disabled or REJECTed at the firewall. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :113
nmap -p 113 <target>
Windows
netstat -ano | findstr :113
Test-NetConnection <host> -Port 113
macOS
lsof -i :113
nmap -p 113 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 113 to your device's local IP, internal port 113, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 113/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=113/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 113 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 113" -Direction Inbound -Protocol TCP -LocalPort 113 -Action Allow

Security & risks

Common attacks

  • Username disclosure of the account owning a connection
  • Reconnaissance probing, classically by IRC servers on connect
  • Spoofed ident responses to evade or mislead access controls

Hardening

  • Disable identd unless a specific service strictly requires it
  • Return a fixed token or random ID instead of real usernames
  • Block or REJECT inbound TCP port 113 at the firewall
  • Prefer REJECT over DROP so clients fail fast instead of hanging

How to block this port

Linux (ufw)
sudo ufw deny 113/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=113/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 113 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 113" -Direction Inbound -Protocol TCP -LocalPort 113 -Action Block

nmap snippet

nmap -p113 --script auth-owners <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 194Port 79Port 25Port 21

Frequently asked questions

What is the Ident protocol on port 113?
Ident (RFC 1413), also called Auth, lets a remote server ask which local username owns an outgoing TCP connection. IRC, mail, and FTP servers historically queried it on connect.
Should I block port 113?
Usually yes — disable identd or REJECT the port. Use REJECT rather than DROP so IRC and mail servers that probe it get an immediate answer instead of waiting for a timeout.

Related guides