Port 49 (TACACS+)

TACACS+ authentication, authorization and accounting for administrators logging into routers and switches.

Well-known (system) port, 0-1023 TCP Directory and authentication Do not expose to the internet

What port 49 is used for

TACACS+ authentication, authorization and accounting for administrators logging into routers and switches.

Do not expose to the internet. Management network only. The protocol's obfuscation is weak; RFC 9887 adds TLS.

Service nameProtoDescriptionAssigneeReference

tacacs TCP Login Host Protocol (TACACS) Pieter Ditmars -

tacacs UDP Login Host Protocol (TACACS) Pieter Ditmars -

Linux: is anything listening on TCP 49?

sudo ss -tlnp 'sport = :49'

Linux / macOS: which process owns the port

sudo lsof -nP -i :49

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':49 '

Windows (Command Prompt)

netstat -ano | findstr :49

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 49 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 49

From Windows

Test-NetConnection HOST -Port 49

ufw

sudo ufw deny 49/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 49 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 49 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 49' -Direction Inbound -Protocol TCP -LocalPort 49 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.