Common attacks and weaknesses
- Brute force against database accounts, including root.
- Data theft and ransom notes left in wiped databases.
- Unencrypted connections when TLS is not required.
Port 3306: MySQL / MariaDB
MySQL and MariaDB database server.
3306
How MySQL / MariaDB works
Databases & cachesThe application sends a SQL query to the MySQL / MariaDB server on port 3306, which returns rows from its tables. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP · UDP
- Exposure risk
- 8/10 high if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Databases & caches
Is port 3306 dangerous?
How to secure it
- Bind to 127.0.0.1 or a private network, never 0.0.0.0 on the Internet.
- Require TLS and strong per-application accounts.
- Remove anonymous users and the test database.
IANA registry entries for port 3306
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| mysql | 3306 | TCP, UDP | MySQL | - | - |
// source: IANA service name and port number registry
Which program uses port 3306, and is it reachable?
Linux
sudo ss -ltnup 'sport = :3306' # process listening on 3306
sudo lsof -nP -i :3306macOS
sudo lsof -nP -i :3306
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 3306 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 3306 netstat -ano | findstr :3306
From another machine
nmap -p 3306 -sV <host> sudo nmap -sU -p 3306 <host> nc -zv <host> 3306
Block it in the firewall
sudo ufw deny 3306/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 3306" -Direction Inbound -LocalPort 3306 -Protocol TCP -Action Block # Windows
What is port 3306 used for?
MySQL and MariaDB database server.
Is port 3306 TCP or UDP?
Port 3306 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 3306?
It is rated 8/10 (high) when exposed to the Internet. Brute force against database accounts, including root. Bind to 127.0.0.1 or a private network, never 0.0.0.0 on the Internet.
How do I check if port 3306 is open?
On Linux run "ss -ltnup 'sport = :3306'", on macOS "lsof -nP -i :3306", and on Windows "netstat -ano | findstr :3306" to see the local process. From another machine, "nmap -p 3306 <host>" shows whether it is reachable.
Other databases & caches ports
:1433 Microsoft SQL Server tcp · udp · high risk :5432 PostgreSQL tcp · udp · high risk :6379 Redis tcp · critical risk :27017 MongoDB tcp · critical risk :9200 Elasticsearch tcp · udp · critical risk :1521 Oracle Database tcp · udp · high risk :11211 Memcached tcp · udp · high risk :5984 CouchDB tcp · udp · high risk