What it is
Remote-procedure-call mappers such as rpcbind/portmapper.
Why it is risky
When open, it enables internal-service enumeration, amplification DDoS, and attacks on vulnerable RPC services.
What to do
Always block it externally; expose only the services you need, on internal networks.
Is it listening on your server?
Linux
ss -ltnp 'sport = :111'Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.