CyberHunter
Local dataset, no network
// Monitoring & logging

Port 514: Syslog

UDP 514 is syslog; TCP 514 is the legacy rsh remote shell.

syslog (UDP)rsh (TCP, legacy)
514

How Syslog works

Monitoring & logging
monitoringdevicesshd: Failedlog monitoringdevicesshd: Failedlog

The monitoring server collects metrics, alerts or logs from devices over port 514. It travels in clear text: anyone on the path can read it.

Transport
UDP · TCP
Exposure risk
5/10 moderate if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned2 registered services
Range
Well-known (0-1023)
Category
Monitoring & logging
01 Security

Is port 514 dangerous?

Common attacks and weaknesses

  • Spoofed or injected log messages.
  • rsh trusts hosts without passwords.

How to secure it

  • Send logs over TLS (6514).
  • Disable rsh entirely.
02 Registry

IANA registry entries for port 514

ServicePortTransportDescriptionReferenceUpdated
shell 514 TCP cmd like exec, but automatic authentication is performed as for login server - -
syslog 514 UDP RFC 5426 2020-06-01

// source: IANA service name and port number registry

03 Check it

Which program uses port 514, and is it reachable?

Linux

sudo ss -ltnup 'sport = :514'      # process listening on 514
sudo lsof -nP -i :514

macOS

sudo lsof -nP -i :514

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 514 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 514
netstat -ano | findstr :514

From another machine

nmap -p 514 -sV <host>
sudo nmap -sU -p 514 <host>
nc -zv <host> 514

Block it in the firewall

sudo ufw deny 514/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 514" -Direction Inbound -LocalPort 514 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 514 used for?

UDP 514 is syslog; TCP 514 is the legacy rsh remote shell.

Is port 514 TCP or UDP?

Port 514 is registered for UDP and TCP.

Is it safe to open port 514?

It is rated 5/10 (moderate) when exposed to the Internet. Spoofed or injected log messages. Send logs over TLS (6514).

How do I check if port 514 is open?

On Linux run "ss -ltnup 'sport = :514'", on macOS "lsof -nP -i :514", and on Windows "netstat -ano | findstr :514" to see the local process. From another machine, "nmap -p 514 <host>" shows whether it is reachable.

05 Related
:161 SNMP udp · tcp · high risk :162 SNMP trap udp · tcp · moderate risk :9090 Prometheus / admin consoles tcp · udp · high risk :6514 Syslog over TLS tcp · udp · dccp · low risk :5601 Kibana tcp · udp · high risk :391 SynOptics SNMP Relay Port tcp · udp :412 Trap Convention Port tcp · udp :561 tcp · udp

Latest vulnerability news

All news