Common attacks and weaknesses
- Toll fraud through weak credentials.
Port 5061: SIP over TLS
Encrypted VoIP signalling.
5061
How SIP over TLS works
Voice & chatPort 5061 sets up the call (who calls whom), then the voice travels as a stream of audio packets. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- TCP · UDP · SCTP
- Exposure risk
- 4/10 moderate if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Voice & chat
Is port 5061 dangerous?
How to secure it
- Strong credentials and SRTP for media.
IANA registry entries for port 5061
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| sips | 5061 | TCP, UDP, SCTP | SIP-TLS | RFC 3263 | 2014-04-09 |
// source: IANA service name and port number registry
Which program uses port 5061, and is it reachable?
Linux
sudo ss -ltnup 'sport = :5061' # process listening on 5061
sudo lsof -nP -i :5061macOS
sudo lsof -nP -i :5061
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 5061 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 5061 netstat -ano | findstr :5061
From another machine
nmap -p 5061 -sV <host> sudo nmap -sU -p 5061 <host> nc -zv <host> 5061
Block it in the firewall
sudo ufw deny 5061/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 5061" -Direction Inbound -LocalPort 5061 -Protocol TCP -Action Block # Windows
What is port 5061 used for?
Encrypted VoIP signalling.
Is port 5061 TCP or UDP?
Port 5061 is registered for TCP and UDP and SCTP. In practice the service mostly uses TCP.
Is it safe to open port 5061?
It is rated 4/10 (moderate) when exposed to the Internet. Toll fraud through weak credentials. Strong credentials and SRTP for media.
How do I check if port 5061 is open?
On Linux run "ss -ltnup 'sport = :5061'", on macOS "lsof -nP -i :5061", and on Windows "netstat -ano | findstr :5061" to see the local process. From another machine, "nmap -p 5061 <host>" shows whether it is reachable.