CyberHunter
Local dataset, no network
// IoT & industrial (ICS)

Port 1883: MQTT

IoT messaging protocol (8883 for MQTT over TLS).

1883

How MQTT works

IoT & industrial (ICS)
producerconsumerqueuePUBLISH producerconsumerqueuePUBLISH

Producers publish messages into a queue on port 1883; consumers pick them up in order, at their own pace. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
7/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
IoT & industrial (ICS)
01 Security

Is port 1883 dangerous?

Common attacks and weaknesses

  • Brokers without authentication exposing sensor data and accepting commands.

How to secure it

  • Require authentication and TLS (8883); restrict topic ACLs.
02 Registry

IANA registry entries for port 1883

ServicePortTransportDescriptionReferenceUpdated
mqtt 1883 TCP, UDP Message Queuing Telemetry Transport Protocol - 2015-02-10

// source: IANA service name and port number registry

03 Check it

Which program uses port 1883, and is it reachable?

Linux

sudo ss -ltnup 'sport = :1883'      # process listening on 1883
sudo lsof -nP -i :1883

macOS

sudo lsof -nP -i :1883

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 1883 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 1883
netstat -ano | findstr :1883

From another machine

nmap -p 1883 -sV <host>
sudo nmap -sU -p 1883 <host>
nc -zv <host> 1883

Block it in the firewall

sudo ufw deny 1883/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 1883" -Direction Inbound -LocalPort 1883 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 1883 used for?

IoT messaging protocol (8883 for MQTT over TLS).

Is port 1883 TCP or UDP?

Port 1883 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 1883?

It is rated 7/10 (high) when exposed to the Internet. Brokers without authentication exposing sensor data and accepting commands. Require authentication and TLS (8883); restrict topic ACLs.

How do I check if port 1883 is open?

On Linux run "ss -ltnup 'sport = :1883'", on macOS "lsof -nP -i :1883", and on Windows "netstat -ano | findstr :1883" to see the local process. From another machine, "nmap -p 1883 <host>" shows whether it is reachable.

05 Related
:8883 MQTT over TLS tcp · udp · moderate risk :502 Modbus TCP tcp · udp · critical risk :102 Siemens S7 (ISO-TSAP) tcp · udp · critical risk :47808 BACnet udp · tcp · critical risk :20000 DNP3 tcp · udp · sctp · critical risk :44818 EtherNet/IP tcp · udp · critical risk :802 Modbus Application Protocol Secure tcp · udp :2221 EtherNet/IP over TLS tcp · udp

Latest vulnerability news

All news