Port 118: SQL Services — DEC's Database Gateway

The Port That Connected Desktops to Mainframes

Port 118 carries SQL Services. Registered in the IANA database under the service name sqlserv, this port was the default listening address for DEC's SQL/Services middleware, the software layer that let client applications on PCs and workstations send SQL queries to databases running on Digital Equipment Corporation's VAX and Alpha servers.¹

When a client application on a DOS machine or a Mac needed to query an Rdb database sitting on a VAX running OpenVMS, port 118 was where it knocked.

How SQL/Services Worked

SQL/Services was a client-server middleware product.² The architecture had three pieces:

1. The client API ran on the desktop machine (DOS, Windows, Mac, or Unix workstation)
2. The network carried the request over DECnet, TCP/IP, NetWare IPX/SPX, or even AppleTalk via a DECnet gateway
3. The SQL/Services server listened on port 118, received the SQL query, executed it against the Rdb database, and sent the results back

The server accepted connections on TCP port 118 and UDP port 118. On DECnet, it used Object 81.³ The client would connect, authenticate, submit SQL statements, and receive result sets. It was ODBC before ODBC became the standard everyone used.

The key insight of SQL/Services was separation. Your application didn't need to know how Rdb stored data internally. It didn't need to run on the same machine as the database. It sent SQL over the network and got answers back. This was the client-server revolution, and DEC was building the plumbing.

The Story of DEC and Rdb

Digital Equipment Corporation released VAX Rdb/VMS in 1984.⁴ It was a relational database for the VAX platform, part of DEC's VAX Information Architecture. Rdb was designed to work with DEC's ecosystem of tools: Datatrieve, the Common Data Dictionary, the Application Control Management System.

SQL/Services was the middleware that made Rdb accessible from the outside world. Before it, you needed to be on the VAX itself to query the database. SQL/Services opened the door, and port 118 was that door.

The registration in IANA's records lists the contact as Larry Barnes at barnes&broke.enet.dec.com.¹ That email domain, broke.enet.dec.com, was part of DEC's internal engineering network. The port was registered by an engineer, for engineers, from inside the company that was trying to make databases talk to everything.

In 1994, DEC sold its Rdb division to Oracle Corporation.⁴ The database became Oracle Rdb. SQL/Services became Oracle SQL/Services. Port 118 stayed the same.

Starting with SQL/Services version 7.0, administrators could configure alternate ports, allowing multiple versions to run simultaneously on the same server.³ Version 7.2.x might listen on port 118 while version 7.3.x listened on port 119. But 118 remained the default, the port you'd check first.

DEC itself was acquired by Compaq in 1998, in what was then the largest merger in computer industry history.⁴ Compaq was later absorbed by HP. The company that registered port 118 no longer exists. But the port assignment persists in the IANA registry, and Oracle Rdb still runs on OpenVMS. Oracle released version 7.4.1.0 in August 2020 and announced a port to x86-64.⁴

Security Considerations

Port 118 carries database queries. Databases hold the data that matters most: financial records, personal information, business logic. Any port serving database traffic should be treated with corresponding seriousness.

Because SQL/Services was designed for enterprise internal networks, security was handled at the network perimeter rather than the protocol level. In modern environments, port 118 should not be exposed to the public Internet. If you see port 118 open on an external-facing machine, something is misconfigured.

The port has also been historically associated with the "Jans" trojan, which used port 118 for command and control communication.⁵ This doesn't mean legitimate SQL Services are dangerous. It means attackers occasionally reuse well-known ports to disguise their traffic as normal.

How to Check What Is Listening on Port 118

Linux:

sudo ss -tlnp | grep :118
sudo lsof -i :118

macOS:

sudo lsof -i :118

Windows:

netstat -an | findstr :118

If something is listening on port 118 and you didn't put it there, investigate immediately. On modern systems, legitimate SQL/Services deployments are rare outside of OpenVMS environments running Oracle Rdb.

The Bigger Picture

Port 118 belongs to the well-known port range (0 through 1023), assigned by IANA and requiring root or system-level privileges to bind on most operating systems.⁶ These ports form the Internet's reserved vocabulary, each one a word with a specific meaning.

Port 118's meaning is narrow and specific: it spoke the language of DEC's database middleware. It served a world where VAX minicomputers were the backbone of enterprise computing and desktop PCs were the newcomers that needed a way in. SQL/Services on port 118 was the translator between those two worlds.

Today, MySQL listens on 3306, PostgreSQL on 5432, Microsoft SQL Server on 1433. Those ports carry the same fundamental idea that port 118 carried first: send a query over the network, get an answer back. The vocabulary changed. The grammar stayed the same.