Common attacks and weaknesses
- MS-CHAPv2 authentication can be cracked; PPTP is considered broken.
Port 1723: PPTP
Point-to-Point Tunneling Protocol, an obsolete VPN.
1723
How PPTP works
VPN, tunnels & proxiesTraffic is wrapped in a tunnel between the two ends, so the network in between only sees the tunnel. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 8/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- VPN, tunnels & proxies
Is port 1723 dangerous?
How to secure it
- Migrate to IKEv2, OpenVPN or WireGuard.
IANA registry entries for port 1723
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| pptp | 1723 | TCP, UDP | pptp | RFC 2637 | 2021-09-21 |
// source: IANA service name and port number registry
Which program uses port 1723, and is it reachable?
Linux
sudo ss -ltnup 'sport = :1723' # process listening on 1723
sudo lsof -nP -i :1723macOS
sudo lsof -nP -i :1723
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 1723 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 1723 netstat -ano | findstr :1723
From another machine
nmap -p 1723 -sV <host> sudo nmap -sU -p 1723 <host> nc -zv <host> 1723
Block it in the firewall
sudo ufw deny 1723/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 1723" -Direction Inbound -LocalPort 1723 -Protocol TCP -Action Block # Windows
What is port 1723 used for?
Point-to-Point Tunneling Protocol, an obsolete VPN.
Is port 1723 TCP or UDP?
Port 1723 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 1723?
It is rated 8/10 (high) when exposed to the Internet. MS-CHAPv2 authentication can be cracked; PPTP is considered broken. Migrate to IKEv2, OpenVPN or WireGuard.
How do I check if port 1723 is open?
On Linux run "ss -ltnup 'sport = :1723'", on macOS "lsof -nP -i :1723", and on Windows "netstat -ano | findstr :1723" to see the local process. From another machine, "nmap -p 1723 <host>" shows whether it is reachable.