Port 2049 NFS – Free, Online, Private

What listens on 2049

Port 2049 is NFS. The IANA name is nfs, Network File System. NFSv2 and NFSv3 used UDP and a cast of side ports from rpcbind: mountd, nlockmgr, statd. NFSv4 is designed to run over TCP 2049 alone, which is the form you can actually firewall. The registry also assigns SCTP. The registry notes a conflict: shilp is listed on 2049 as well. You will not meet shilp on a Linux file server. You will meet nfsd. A showmount or a mount -t nfs that works is this service. SMB is 445. rsync is 873 or SSH.

The IANA service name is nfs: Network File System - Sun Microsystems. The practical transport is TCP and UDP. The checks below include both TCP and UDP, because both transports matter for this service. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 2049

Service notes for port 2049: the IANA name is nfs (Network File System - Sun Microsystems), and the program people mean is NFS. Port 2049 is the IANA nfs port, Sun's Network File System, on TCP, UDP, and SCTP. The registry also records a conflict with shilp on the same number. NFS trust is often by client IP and by numeric uid. Both are weak on a network where a laptop can choose its address and its uid. Do not export to the internet. Use an export list, root_squash, and NFSv4 with Kerberos if the files matter. A world-exported / is a remote root shell in practice. Firewall TCP 2049 to the clients that mount it. Leaving UDP 2049 open for a v4-only server adds a protocol you do not use. rpcbind on 111 is a separate exposure and a separate decision. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 2049, you are on the wrong page.

A security group that allows 2049 and blocks 111 will mount NFSv4 and fail NFSv3 with a confusing timeout. Know which version you promised. Another trap is an export to a hostname that resolves to an old address. Another is idmap mismatches, so files appear owned by nobody and the port is blamed. Another is testing UDP with nc and concluding NFS is down when the server is TCP-only, which is what you wanted. A client mount that hangs is often a firewall dropping the reply, not a daemon that crashed. ss still shows nfsd.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 2049 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. On Linux, nfsd threads hold TCP 2049 when the server is up. exportfs -v lists who may mount. From a client, a mount is the real test. A TCP connect only proves the port.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• NFSv3 needs rpcbind and several other ports. NFSv4 can live on TCP 2049 alone.
• The IANA entry conflicts with shilp. File servers are nfs.
• Exports trust client identity. The port being filtered is not the only control.
• SMB is 445, not 2049.

Linuxsudo ss -lptn 'sport = :2049'
sudo lsof -nP -iTCP:2049 -sTCP:LISTEN
sudo ss -lpun 'sport = :2049'
sudo lsof -nP -iUDP:2049

macOSsudo lsof -nP -iTCP:2049 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.2049[^0-9]'
sudo lsof -nP -iUDP:2049
netstat -anv -p udp | grep '\.2049[^0-9]'

Windowsnetstat -ano | findstr :2049
Get-NetTCPConnection -LocalPort 2049
Get-NetUDPEndpoint -LocalPort 2049

Remotenc -vz host 2049
nc -vzu host 2049