Port reference
Port 1911 (TCP) – Tridium Niagara Fox
Fox protocol used by Tridium Niagara building-automation framework to connect stations, JACE controllers, and workbench tools.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on Tridium Niagara JACE controllers and Supervisor stations running the Fox service (1911 plain, 4911 TLS).
What is port 1911 used for?
Port 1911 carries the Fox protocol, the communication layer of the Tridium Niagara building-automation framework (Niagara AX and N4). It links JACE field controllers, Supervisor stations, and the Workbench engineering tool that technicians use to manage HVAC, lighting, access control, and energy systems in commercial buildings. The plaintext service runs on 1911; the TLS-secured variant uses 4911.
When would you open it?
You'd allow 1911 (or 4911) only between Niagara controllers, their Supervisor, and the engineering workstations that program them. This belongs strictly on an isolated building-automation network, not on a general LAN and never forwarded to the internet.
Is it safe to open?
Building-automation gear is a sensitive target with a history of default credentials and old firmware, so keep it on an isolated network, use the TLS port 4911, and set strong unique passwords. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1911
nmap -p 1911 <target>netstat -ano | findstr :1911
Test-NetConnection <host> -Port 1911lsof -i :1911
nmap -p 1911 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1911 to your device's local IP, internal port 1911, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1911/tcpsudo firewall-cmd --permanent --add-port=1911/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1911 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1911" -Direction Inbound -Protocol TCP -LocalPort 1911 -Action AllowSecurity & risks
Common attacks
- Station and version enumeration via the fox-info script
- Exploitation of known Niagara CVEs (path traversal, weak crypto)
- Credential brute force and default-account abuse
- Internet exposure discovery via Shodan/Censys
Hardening
- Never expose port 1911/4911 to the internet — keep BAS on an isolated network
- Patch Niagara to a current release and remove default accounts
- Use the TLS Fox port (4911) and enforce strong unique credentials
- Segment with firewalls and restrict access to authorized engineering hosts
How to block this port
sudo ufw deny 1911/tcpsudo firewall-cmd --permanent --remove-port=1911/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1911 -j DROPNew-NetFirewallRule -DisplayName "Block 1911" -Direction Inbound -Protocol TCP -LocalPort 1911 -Action Blocknmap snippet
nmap -p1911 --script fox-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the Fox protocol on port 1911?
- Fox is the proprietary protocol of the Tridium Niagara building-automation framework. It links JACE controllers, Supervisor stations, and the Workbench tool. Port 1911 is plaintext; 4911 is the TLS variant.
- Is Niagara Fox safe to expose online?
- No. Niagara stations have a history of CVEs and weak default configurations, and thousands have been found exposed on Shodan. Building automation should never be directly reachable from the internet.