Common attacks and weaknesses
- Open TURN relays abused to reach internal networks.
Port 3478: STUN / TURN
NAT traversal for WebRTC and VoIP.
3478
How STUN / TURN works
Voice & chatPort 3478 sets up the call (who calls whom), then the voice travels as a stream of audio packets. It travels in clear text: anyone on the path can read it.
- Transport
- UDP · TCP
- Exposure risk
- 3/10 moderate if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned3 registered services
- Range
- Registered (1024-49151)
- Category
- Voice & chat
Is port 3478 dangerous?
How to secure it
- Require TURN credentials and deny relaying to private ranges.
IANA registry entries for port 3478
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| stun | 3478 | TCP, UDP | Session Traversal Utilities for NAT (STUN) port | RFC 8489 | 2019-03-28 |
| stun-behavior | 3478 | TCP, UDP | STUN Behavior Discovery over TCP | RFC 5780 | - |
| turn | 3478 | TCP, UDP | TURN over TCP | RFC 8656 | 2019-08-02 |
// source: IANA service name and port number registry
Which program uses port 3478, and is it reachable?
Linux
sudo ss -ltnup 'sport = :3478' # process listening on 3478
sudo lsof -nP -i :3478macOS
sudo lsof -nP -i :3478
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 3478 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 3478 netstat -ano | findstr :3478
From another machine
nmap -p 3478 -sV <host> sudo nmap -sU -p 3478 <host> nc -zv <host> 3478
Block it in the firewall
sudo ufw deny 3478/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 3478" -Direction Inbound -LocalPort 3478 -Protocol TCP -Action Block # Windows
What is port 3478 used for?
NAT traversal for WebRTC and VoIP.
Is port 3478 TCP or UDP?
Port 3478 is registered for UDP and TCP.
Is it safe to open port 3478?
It is rated 3/10 (moderate) when exposed to the Internet. Open TURN relays abused to reach internal networks. Require TURN credentials and deny relaying to private ranges.
How do I check if port 3478 is open?
On Linux run "ss -ltnup 'sport = :3478'", on macOS "lsof -nP -i :3478", and on Windows "netstat -ano | findstr :3478" to see the local process. From another machine, "nmap -p 3478 <host>" shows whether it is reachable.