Common attacks and weaknesses
- Query amplification and DDoS.
Source engine game servers and Steam.
The game client and server exchange small updates many times per second over port 27015. It travels in clear text: anyone on the path can read it.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
No entry. The port is free for any application, so check what uses it on your hosts.
// source: IANA service name and port number registry
Linux
sudo ss -ltnup 'sport = :27015' # process listening on 27015
sudo lsof -nP -i :27015macOS
sudo lsof -nP -i :27015
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 27015 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 27015 netstat -ano | findstr :27015
From another machine
nmap -p 27015 -sV <host> sudo nmap -sU -p 27015 <host> nc -zv <host> 27015
Block it in the firewall
sudo ufw deny 27015/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 27015" -Direction Inbound -LocalPort 27015 -Protocol TCP -Action Block # Windows
Source engine game servers and Steam.
Port 27015 is registered for UDP and TCP.
It is rated 3/10 (moderate) when exposed to the Internet. Query amplification and DDoS. Rate-limit queries and keep servers updated.
On Linux run "ss -ltnup 'sport = :27015'", on macOS "lsof -nP -i :27015", and on Windows "netstat -ano | findstr :27015" to see the local process. From another machine, "nmap -p 27015 <host>" shows whether it is reachable.