Port 1110: NFS Status Services — Keeping Watch on the File Watchers

Port 1110 sits in the registered ports range (1024-49151), officially assigned by IANA for Network File System (NFS) cluster coordination.

What Runs Here

Port 1110 has two service assignments:¹

• TCP 1110: nfsd-status — Cluster status information
• UDP 1110: nfsd-keepalive — Client status information

These services support NFS cluster operations—the coordination layer that keeps distributed file servers synchronized and aware of each other's status.

The NFS Family of Ports

NFS isn't a single port. It's a constellation:²

• Port 2049: The main NFS daemon (nfsd) that actually serves files
• Port 111: RPC portmap/rpcbind for service discovery
• Port 1110: Cluster status and keepalive (what we're discussing)

Think of it this way: port 2049 is the librarian handing you books. Port 1110 is the librarian checking in with other librarians to make sure they're still there and the library system is functioning.

How It Works

nfsd-status (TCP) provides cluster status information. When you're running NFS in a clustered environment—multiple servers sharing the load of file serving—they need to know about each other. Is server B still alive? Did server C just go down? This metadata flows through port 1110.

nfsd-keepalive (UDP) handles client status information. Clients send keepalive messages to signal "I'm still here, don't time out my connection." UDP makes sense here because losing an occasional keepalive packet isn't catastrophic—the next one will arrive in a few seconds.

The Keepalive Problem

Every distributed system faces the same question: how do you know if a remote machine has crashed or just gotten slow?

You send keepalive messages. Small packets that say "I'm alive." If they stop arriving, you know something's wrong. Port 1110 is where NFS does this checking—both for cluster members watching each other and clients reassuring servers.

It's the digital equivalent of "You still there?" repeated every few seconds, forever.

Unofficial Uses

Port 1110 also appears in the wild for:³

• VMware vCenter and vSphere remote management services
• VMware Distributed Resource Scheduler (DRS)
• VMware vCenter Converter
• EasyBits School network discovery protocol (Intel CMPC platform)

None of these are official assignments. They're applications that picked port 1110 because it was available in their environment. This is common in the registered range—IANA assigns the port, but enforcement is impossible. If your network doesn't run NFS, another application can use 1110 without conflict.

Security Considerations

If you're running NFS, port 1110 should only be accessible within your trusted network. These status messages reveal cluster topology and client activity—information an attacker could use to map your infrastructure.

Firewall rules: Block port 1110 (both TCP and UDP) at your network perimeter. NFS was designed for LANs, not the Internet.

What's listening? Check with:

# See what's using port 1110
sudo lsof -i :1110

# Or with netstat
sudo netstat -tulpn | grep 1110

# Or with ss (modern Linux)
sudo ss -tulpn | grep 1110

If you see something listening on 1110 and you're not running NFS clusters, investigate. It could be legitimate (VMware tools) or something that shouldn't be there.

Why This Port Matters

Port 1110 represents a pattern you see throughout network protocols: the metadata port.

The main work happens elsewhere (NFS on 2049), but you need a separate channel for "how are we doing?" information. Web servers serve content on port 80, but monitoring systems check their health on other ports. Databases accept queries on 3306 or 5432, but report metrics elsewhere.

Port 1110 is NFS asking itself "are we okay?" It's the nervous system checking in with itself—essential for reliability, invisible when working correctly.

Related Ports

• Port 111: RPC portmapper (NFS service discovery)
• Port 2049: NFS server daemon (actual file sharing)
• Port 4045: NFS lock manager (nlockmgr)