CyberHunter
Local dataset, no network
// Media & streaming

Port 554: RTSP

Video streaming control, common on IP cameras.

Real Time Streaming Protocol
554

How RTSP works

Media & streaming
playercameraPLAY playercameraPLAY

The device streams video frames over port 554, continuously, as they are captured. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
6/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
Media & streaming
01 Security

Is port 554 dangerous?

Common attacks and weaknesses

  • Cameras streaming without authentication.

How to secure it

  • Require authentication and keep cameras off the Internet.
02 Registry

IANA registry entries for port 554

ServicePortTransportDescriptionReferenceUpdated
rtsp 554 TCP, UDP Real Time Streaming Protocol (RTSP) - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 554, and is it reachable?

Linux

sudo ss -ltnup 'sport = :554'      # process listening on 554
sudo lsof -nP -i :554

macOS

sudo lsof -nP -i :554

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 554 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 554
netstat -ano | findstr :554

From another machine

nmap -p 554 -sV <host>
sudo nmap -sU -p 554 <host>
nc -zv <host> 554

Block it in the firewall

sudo ufw deny 554/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 554" -Direction Inbound -LocalPort 554 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 554 used for?

Video streaming control, common on IP cameras.

Is port 554 TCP or UDP?

Port 554 is registered for TCP and UDP.

Is it safe to open port 554?

It is rated 6/10 (high) when exposed to the Internet. Cameras streaming without authentication. Require authentication and keep cameras off the Internet.

How do I check if port 554 is open?

On Linux run "ss -ltnup 'sport = :554'", on macOS "lsof -nP -i :554", and on Windows "netstat -ano | findstr :554" to see the local process. From another machine, "nmap -p 554 <host>" shows whether it is reachable.

05 Related
:1935 RTMP tcp · udp · moderate risk :201 AppleTalk Routing Maintenance tcp · udp :469 Radio Control Protocol tcp · udp :537 Networked Media Streaming Protocol tcp · udp :583 Philips Video-Conferencing tcp · udp :651 IEEE MMS tcp · udp :695 IEEE-MMS-SSL tcp · udp :1347 multi media conferencing tcp · udp

Latest vulnerability news

All news