Common attacks and weaknesses
- Extension scanning and toll fraud through brute-forced accounts.
Port 5060: SIP
VoIP signalling (5061 for SIP over TLS).
5060
How SIP works
Voice & chatPort 5060 sets up the call (who calls whom), then the voice travels as a stream of audio packets. It travels in clear text: anyone on the path can read it.
- Transport
- UDP · TCP · SCTP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Voice & chat
Is port 5060 dangerous?
How to secure it
- Use strong SIP passwords, rate limiting, geo restrictions and SIP over TLS.
IANA registry entries for port 5060
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| sip | 5060 | TCP, UDP, SCTP | SIP | RFC 3263 | 2014-04-09 |
// source: IANA service name and port number registry
Which program uses port 5060, and is it reachable?
Linux
sudo ss -ltnup 'sport = :5060' # process listening on 5060
sudo lsof -nP -i :5060macOS
sudo lsof -nP -i :5060
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 5060 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 5060 netstat -ano | findstr :5060
From another machine
nmap -p 5060 -sV <host> sudo nmap -sU -p 5060 <host> nc -zv <host> 5060
Block it in the firewall
sudo ufw deny 5060/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 5060" -Direction Inbound -LocalPort 5060 -Protocol TCP -Action Block # Windows
What is port 5060 used for?
VoIP signalling (5061 for SIP over TLS).
Is port 5060 TCP or UDP?
Port 5060 is registered for UDP and TCP and SCTP. In practice the service mostly uses UDP and TCP.
Is it safe to open port 5060?
It is rated 6/10 (high) when exposed to the Internet. Extension scanning and toll fraud through brute-forced accounts. Use strong SIP passwords, rate limiting, geo restrictions and SIP over TLS.
How do I check if port 5060 is open?
On Linux run "ss -ltnup 'sport = :5060'", on macOS "lsof -nP -i :5060", and on Windows "netstat -ano | findstr :5060" to see the local process. From another machine, "nmap -p 5060 <host>" shows whether it is reachable.