Port 644: The ambiguous mount port — When official records and reality diverge

The Ambiguity

Port 644 sits in the well-known ports range (0-1023), a space supposedly under careful control by the Internet Assigned Numbers Authority (IANA). These ports are meant to have clear, official assignments. But port 644 exists in a strange state: you'll find it in use on real systems, yet its official status is unclear.¹

What Actually Uses Port 644

In practice, port 644 appears on macOS systems running NFS (Network File System) services. Specifically, the mount protocol—the mechanism that handles mounting remote file systems—can be reached at port 644 on both TCP and UDP.²

The mount protocol (defined in RFC 1094 for NFSv2 and RFC 1813 for NFSv3) is an NFS "side protocol"—it handles the initial handshake that establishes a remote filesystem mount before the actual NFS file operations begin.³ It runs on top of RPC (Remote Procedure Call) as program number 100005.

But here's the strange part: while you'll find references to port 644 being used for mount protocol in various technical documentation and network scanning tools, the official IANA registry doesn't clearly list it as an assigned port.⁴

The Well-Known Ports Range

Port 644 falls in the well-known ports range (0-1023). These ports were meant to be the carefully controlled foundation of Internet services—assigned only through official IANA procedures, reserved for system services that typically require root privileges to bind.

The well-known range represents the original vision of port organization: a curated list of standard services that every Internet-connected machine would recognize. Telnet on 23. SMTP on 25. HTTP on 80. Clear, official, unchanging.

Port 644 doesn't fit that pattern cleanly.

Why This Ambiguity Exists

The disconnect between official registry and actual use reveals something important about how network protocols evolve. RPC-based services like NFS don't use fixed ports the way traditional services do. Instead, they use a portmapper (or rpcbind) service that runs on port 111 and directs clients to whichever dynamic port the service is actually using.

In theory, mount protocol doesn't need a fixed port—clients should query the portmapper to find it. In practice, some implementations (particularly on macOS) bind it to port 644 by default. The port shows up in firewall rules, network scans, and system configurations, even if it was never meant to be a permanent, official assignment.⁵

This is how the port system actually works: official standards layer beneath actual practice, and sometimes they don't align perfectly.

Security Considerations

If you find port 644 open on a system, it likely indicates NFS services are running. NFS has a complex security history:

• Older NFS versions transmitted data unencrypted
• Authentication was often based on IP addresses and UID/GID values that could be spoofed
• The mount protocol itself reveals information about exported filesystems

Modern NFS implementations (NFSv4 and later) have better security, but an open mount protocol port on an Internet-facing system is worth investigating. It should typically only be accessible within trusted networks.

Checking Port 644

To see what's listening on port 644 on your system:

Linux/macOS:

sudo lsof -i :644
sudo netstat -an | grep 644

Check if it's an RPC service:

rpcinfo -p | grep mount

The rpcinfo command queries the portmapper to see what RPC services are registered and which ports they're actually using.

Why Unassigned Ports Matter

The existence of ports like 644—used in practice but ambiguous in official records—matters because it reveals the gap between how we think the Internet works and how it actually works.

We imagine port assignments as a clean registry: every port has a purpose, every service has a port, everything is documented. The reality is messier. Services evolve. Implementations make choices. Defaults stick around long after the reasons for them are forgotten. And sometimes a port ends up in widespread use without ever getting a clear stamp of official approval.

The port system still works, not because every detail is perfectly controlled, but because it's flexible enough to handle these ambiguities. Port 644 carries mount protocol traffic when systems expect it to, whether or not IANA explicitly blessed that use.

This is infrastructure: the parts that work well enough that we stopped questioning them, even when the official documentation doesn't quite match what's actually running.

Related Ports

• Port 111 — Portmapper/rpcbind, the service that tells clients where RPC services like mount protocol are actually listening
• Port 2049 — NFS, the actual Network File System protocol for file operations
• Port 635 — Also associated with mount protocol on some systems