CyberHunter
Local dataset, no network
// Media & streaming

Port 1935: RTMP

Live video ingest (OBS, streaming platforms).

Real-Time Messaging Protocol
1935

How RTMP works

Media & streaming
playercamerapublish playercamerapublish

The device streams video frames over port 1935, continuously, as they are captured. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
3/10 moderate if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
01 Security

Is port 1935 dangerous?

Common attacks and weaknesses

  • Stream keys sent in clear text.

How to secure it

  • Use RTMPS (TLS).
02 Registry

IANA registry entries for port 1935

ServicePortTransportDescriptionReferenceUpdated
macromedia-fcs 1935 TCP, UDP Macromedia Flash Communications Server MX - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 1935, and is it reachable?

Linux

sudo ss -ltnup 'sport = :1935'      # process listening on 1935
sudo lsof -nP -i :1935

macOS

sudo lsof -nP -i :1935

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 1935 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 1935
netstat -ano | findstr :1935

From another machine

nmap -p 1935 -sV <host>
sudo nmap -sU -p 1935 <host>
nc -zv <host> 1935

Block it in the firewall

sudo ufw deny 1935/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 1935" -Direction Inbound -LocalPort 1935 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 1935 used for?

Live video ingest (OBS, streaming platforms).

Is port 1935 TCP or UDP?

Port 1935 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 1935?

It is rated 3/10 (moderate) when exposed to the Internet. Stream keys sent in clear text. Use RTMPS (TLS).

How do I check if port 1935 is open?

On Linux run "ss -ltnup 'sport = :1935'", on macOS "lsof -nP -i :1935", and on Windows "netstat -ano | findstr :1935" to see the local process. From another machine, "nmap -p 1935 <host>" shows whether it is reachable.

05 Related

Latest vulnerability news

All news