Port 556: RFS server — The file sharing protocol Unix forgot

What This Port Does

Port 556 is officially assigned to remotefs (RFS server) for both TCP and UDP.¹ RFS stands for Remote File Sharing—a protocol from AT&T Unix System V designed in the 1980s to let systems access remote files as if they were local.²

You will almost certainly never encounter RFS running on port 556. The protocol is obsolete.

The History You Need to Know

RFS emerged from AT&T's Unix System V in the 1980s as a solution for transparent file sharing between Unix systems. It integrated directly into the kernel's file system namespace, allowing remote resources to appear seamlessly local.²

But RFS had problems. It didn't scale well. The protocol wasn't extensible. And when Sun Microsystems released NFS (Network File System), the Unix world moved on. Later, SMB/CIFS dominated Windows file sharing. RFS lost on both fronts.

By the 1990s, RFS was effectively dead. Most network engineers today have never heard of it.

Why This Port Still Exists

Port 556 sits in the well-known ports range (0-1023)—ports assigned by IANA for standardized services that once mattered enough to deserve permanent numbers.¹

The assignment remains because IANA doesn't revoke port numbers when protocols die. Port 556 is a tombstone. It marks where RFS used to be, even though nothing lives there anymore.

What Actually Runs on Port 556 Today

Probably nothing.

If you find something listening on port 556, it's either:

• A legacy Unix system so old that "legacy" is an understatement
• Custom software that chose port 556 because it's usually available
• A security researcher testing for systems running ancient, unpatched software

Check what's listening on your system:

# Linux/Mac
sudo lsof -i :556
sudo netstat -tlnp | grep :556

# Windows
netstat -ano | findstr :556

If something answers, investigate. It's unusual enough to warrant attention.

Security Considerations

RFS itself is not a modern security threat—you can't be exploited by a protocol that doesn't run anywhere. But the port number matters for two reasons:

Historical vulnerability research: Security researchers sometimes scan for port 556 to identify extremely old Unix systems that might be running unpatched software from the 1980s or 1990s. If RFS is running, everything else on that system is probably ancient too.

Port availability: Because port 556 is rarely used, some custom applications might choose it for unofficial purposes. If you're running a security audit and find port 556 open, determine what's actually using it.

Related Ports

The protocols that replaced RFS:

• Port 2049: NFS (Network File System) — the Unix/Linux file sharing protocol that won
• Port 445: SMB (Server Message Block) — Windows file sharing that also works on modern Unix systems

How to Check If You're Using This Port

Most systems won't have anything on port 556. To verify:

On Linux/Mac:

sudo lsof -i :556

On Windows:

netstat -ano | findstr :556

No output means nothing is listening. That's normal.