Port 369 is officially assigned to rpc2portmap—the portmapper for RPC2 (Remote Procedure Call version 2), a protocol created at Carnegie Mellon University for distributed filesystems.12
What It Does
The RPC2 portmapper listens on port 369 and maintains a registry of active RPC2 services and their network endpoints.3 When a client needs to access a remote service in the Coda distributed filesystem, it queries port 369 to discover which port that service is actually listening on.
Think of it as a directory service. Clients don't need to know every port number in advance—they just ask the portmapper, and it tells them where to find what they need.
The Protocol: RPC2
RPC2 is a remote procedure call protocol built on top of IP/UDP.4 It was designed and implemented by M. Satyanarayanan (known as "Satya") at Carnegie Mellon, with the first operational version appearing in mid-1985.5
RPC2 runs on LWP (Lightweight Process), a threading package that allows multiple non-preemptive threads to coexist within a single Unix process—entirely at user-level, no kernel modifications required.4
The protocol was originally created for the Andrew File System (AFS), which pioneered scalable distributed file access for tens of thousands of machines in the 1980s.6 It later became the foundation for the Coda File System, where it remains in use today.
The Story
In 1983, Carnegie Mellon and IBM partnered to build Andrew—a distributed workstation environment that would let thousands of machines share file data securely and efficiently.6 The problem was unprecedented: how do you make remote file access feel local when you have that many clients?
Satya designed RPC2 to solve part of that puzzle. The protocol needed to be portable, extensible, and efficient. It needed to handle streaming file transfers (via the SFTP side effect mechanism) and parallel calls (via MultiRPC).4 And it needed a way for clients to dynamically discover services without hardcoding port numbers everywhere.
That's what port 369 does. It's the first place an RPC2 client looks when it needs to find a service.
The Andrew File System won the ACM Software System Award in 2016 for its influence and impact.6 AFS became one of the most widely deployed distributed filesystems in academic and research institutions. Coda, its successor, continues that lineage.
Coda's Port Family
Port 369 is part of a family of IANA-assigned ports for the Coda filesystem:7
- 369 — rpc2portmap (the portmapper)
- 370 — codaauth2 (authentication server)
- 2430 — venus (client-side cache manager)
- 2431 — venus-se (side effects)
- 2432 — codasrv (server)
- 2433 — codasrv-se (side effects)
These ports form the infrastructure that makes Coda's distributed filesystem work.
Security Considerations
Because port 369 acts as a service registry, it can be a reconnaissance target. An attacker querying the portmapper can enumerate which RPC2 services are running on a system.
Some third-party sources have flagged port 369 as previously used by malware for command-and-control communications.8 This doesn't mean the RPC2 protocol itself is malicious—it means attackers have occasionally repurposed this port for other uses.
If you're not running Coda or another RPC2-based system, there's no reason for port 369 to be open. Firewall it.
Checking What's Listening
On Linux or macOS:
On Windows:
If you see something listening on port 369 and you're not running Coda, investigate. It shouldn't be open.
Why This Port Matters
Port 369 represents a lineage. Andrew File System → AFS → Coda. This is infrastructure that taught the world how to build distributed filesystems at scale.
Most modern systems don't use RPC2 anymore. But the problems it solved—service discovery, scalable remote access, efficient file transfer across thousands of clients—those problems are still being solved today, just with different tools.
Port 369 is a reminder that someone had to figure this out the first time. Satya and his team at Carnegie Mellon did that in the mid-1980s, and the port assignment remains.
Related Ports
- Port 111 — SUN RPC Portmapper (the more widely known portmapper)
- Port 370 — Coda Authentication Server
- Port 2049 — NFS (another distributed filesystem protocol)
Frequently Asked Questions
Was this page helpful?