Port 4444 (Metasploit default / krb524)

IANA-assigned to krb524, but best known as the default listener port of Metasploit reverse shells; Selenium Grid also used 4444.

Registered (user) port, 1024-49151 TCP Security Do not expose to the internet

What port 4444 is used for

IANA-assigned to krb524, but best known as the default listener port of Metasploit reverse shells; Selenium Grid also used 4444.

Do not expose to the internet. Unexpected outbound connections to 4444 often indicate a compromised host running a reverse shell.

Service nameProtoDescriptionAssigneeReference

krb524 TCP KRB524 B Clifford Neuman -

nv-video TCP NV Video default Ron Frederick -

krb524 UDP KRB524 B Clifford Neuman -

nv-video UDP NV Video default Ron Frederick -

Linux: is anything listening on TCP 4444?

sudo ss -tlnp 'sport = :4444'

Linux / macOS: which process owns the port

sudo lsof -nP -i :4444

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':4444 '

Windows (Command Prompt)

netstat -ano | findstr :4444

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 4444 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 4444

From Windows

Test-NetConnection HOST -Port 4444

ufw

sudo ufw deny 4444/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 4444 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 4444 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 4444' -Direction Inbound -Protocol TCP -LocalPort 4444 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.