Port 112: McIDAS — The Weather Watcher's Wire

Port 112 carries the McIDAS Data Transmission Protocol. Every time a meteorologist pulls satellite imagery from a remote weather data server, every time a forecaster requests real-time radar overlays or numerical weather model output, there is a good chance that request travels through port 112. This is the port that watches the sky.

What Port 112 Does

Port 112 is assigned by IANA¹ to McIDAS (Man-computer Interactive Data Access System) for both TCP and UDP. It serves as the communication channel for ADDE (Abstract Data Distribution Environment), the client-server protocol that McIDAS uses to distribute weather data across networks.

When a McIDAS workstation needs satellite imagery, radar data, or atmospheric observations, it opens a TCP connection to port 112 on a remote server. The client sends a request for a named dataset. The server resolves where that data lives, retrieves it, and streams it back. The client never needs to know the file format or storage location. Port 112 abstracts all of that away.²

The protocol is straightforward: the client connects to port 112 on the server, and the server responds on the same connection. There is no return connection from server to client. The operating system assigns a random local port for the client side. This simplicity is part of why it has lasted so long.

How ADDE Works

ADDE follows a clean client-server model built on TCP/IP.² Each McIDAS workstation acts as both a client and a local server. When a user makes a data request:

1. The application extracts a group name from the request
2. The group name is checked against a client routing table to determine whether the data lives locally or on a remote server
3. If remote, a TCP connection is opened to port 112 on the target server
4. The server starts a process, resolves the dataset name using its own mapping table, locates the data, and streams it back
5. The client processes and displays the data

Users request data from named datasets rather than raw file paths. A forecaster does not need to remember the arcane naming conventions of satellite data files. They just ask for a dataset by name, and the network figures out the rest.

The distributed nature of ADDE means that cooperating weather stations can act as safety nets for each other. If your station missed a data file, you can transparently pull it from another station. ADDE calls this a "distributed, ad hoc, short-term data archive facility."³

The Story Behind Port 112

The story of port 112 begins with a cornfield.

In 1953, a Finnish-American scientist named Verner Suomi measured the heat budget of a corn field for his doctoral thesis at the University of Chicago.⁴ That measurement made him think: if you can measure the heat of a cornfield, you could measure the heat budget of the entire Earth. The obvious way to do that was from space.

Suomi spent the next decade turning that idea into reality. On October 13, 1959, his flat plate radiometer launched aboard Explorer 7, and the era of satellite meteorology began.⁵ Data from that instrument revealed something surprising: Earth absorbed more of the sun's energy than scientists had assumed.

In 1965, Suomi and Robert Parent founded the Space Science and Engineering Center (SSEC) at the University of Wisconsin-Madison.⁵ SSEC became the birthplace of spin-scan camera technology, which gave humanity its first continuous view of weather from geostationary orbit. For the first time, the clouds moved and the Earth stood still.

But Suomi had created a monster: a flood of satellite data pouring down from orbit with no good way to handle it. Even he admitted the deluge was overwhelming.⁶

The answer was McIDAS. The first system was completed in June 1973.⁶ It could ingest cloud imagery, Synchronous Meteorological Satellite data, FAA feeds, and National Weather Service radar, overlaying all of it on hand-drawn vector maps. Researcher Tom Whittaker later called it "likely the first GIS system in the world."⁶

By October 1973, McIDAS was feeding real-time weather visualizations to the local Wisconsin public television station. After a devastating tornado killed dozens in Wichita Falls, Texas in 1979, Congress directed that a McIDAS system be installed at the National Severe Storms Forecast Center.⁶

The system evolved through five generations: from mainframes to Harris/6 clusters to IBM PCs to OS/2 to Unix. In 1993, SSEC built the Data Distribution Environment (DDE) to distribute data across networks. They renamed it to ADDE in 1994 (to avoid confusion with Microsoft's DDE).³ Port 112 was registered with IANA by Unidata for McIDAS data, and starting with McIDAS version 2004 and above, it became the sole port for all ADDE communications.⁷

What McIDAS Carries

Through port 112, McIDAS distributes four types of data:²

• Image data: Satellite imagery from geostationary and polar-orbiting satellites
• Point data: Surface observations, radiosonde readings, aircraft reports
• Grid data: Numerical weather model output, analysis fields
• Text data: Weather bulletins, forecasts, warnings

This data flows between research universities, national weather services, NASA, and NOAA. When a hurricane forecast depends on the latest satellite imagery, when a severe weather warning requires real-time radar composites, the data often travels through the protocol that listens on port 112.

Still Running

McIDAS consists of over 1.5 million lines of code across nearly four thousand modules.⁶ SSEC has committed to supporting it through at least the end of the GOES-R satellite series, currently projected to run through 2036. A fifth generation, McIDAS-V, is now free and open source.

Port 112 has been carrying weather data for over two decades in its current form, serving a software system that has been running continuously since 1973. Over fifty years. That is not a protocol. That is an institution.

Security Considerations

Port 112 is not a common attack target, but it shares the risks of any well-known port. UDP traffic on port 112 has been associated with some trojan activity in the past, though this reflects opportunistic malware choosing low-profile ports rather than any vulnerability in McIDAS itself.⁸

Because McIDAS is specialized meteorological software, port 112 is unlikely to be open on most systems. If you find it listening on a machine that should not be running weather data services, investigate.

How to Check What Is Listening on Port 112

Linux:

sudo ss -tlnp | grep :112
sudo lsof -i :112

macOS:

sudo lsof -i :112

Windows:

netstat -ano | findstr :112

If nothing is listening, that is expected. Port 112 is quiet on most machines. It speaks only to those who watch the weather.