Common attacks and weaknesses
- Open proxies relaying abuse.
- Access to internal resources through the proxy.
Port 3128: Squid proxy
Default port of the Squid HTTP proxy.
3128
How Squid proxy works
VPN, tunnels & proxiesTraffic is wrapped in a tunnel between the two ends, so the network in between only sees the tunnel. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- VPN, tunnels & proxies
Is port 3128 dangerous?
How to secure it
- Restrict allowed clients (ACLs) and require authentication.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 3128
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ndl-aas | 3128 | TCP, UDP | Active API Server Port | - | - |
// source: IANA service name and port number registry
Which program uses port 3128, and is it reachable?
Linux
sudo ss -ltnup 'sport = :3128' # process listening on 3128
sudo lsof -nP -i :3128macOS
sudo lsof -nP -i :3128
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 3128 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 3128 netstat -ano | findstr :3128
From another machine
nmap -p 3128 -sV <host> sudo nmap -sU -p 3128 <host> nc -zv <host> 3128
Block it in the firewall
sudo ufw deny 3128/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 3128" -Direction Inbound -LocalPort 3128 -Protocol TCP -Action Block # Windows
What is port 3128 used for?
Default port of the Squid HTTP proxy.
Is port 3128 TCP or UDP?
Port 3128 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 3128?
It is rated 6/10 (high) when exposed to the Internet. Open proxies relaying abuse. Restrict allowed clients (ACLs) and require authentication.
How do I check if port 3128 is open?
On Linux run "ss -ltnup 'sport = :3128'", on macOS "lsof -nP -i :3128", and on Windows "netstat -ano | findstr :3128" to see the local process. From another machine, "nmap -p 3128 <host>" shows whether it is reachable.