Port 5061 (SIP over TLS)

SIP signaling encrypted with TLS; Microsoft Teams Direct Routing and many carriers require it.

Registered (user) port, 1024-49151 TCP Voice, video and chat Expose only to trusted sources

What port 5061 is used for

SIP signaling encrypted with TLS; Microsoft Teams Direct Routing and many carriers require it.

Expose only to trusted sources. Same toll-fraud risks as 5060 if credentials are weak; restrict to your provider's IP ranges.

Service nameProtoDescriptionAssigneeReference

sips TCP SIP-TLS - RFC 3263

sips UDP SIP-TLS - RFC 3263

sips SCTP SIP-TLS - RFC 4168

Registry dates for this port: last modified 2014-04-09.

Linux: is anything listening on TCP 5061?

sudo ss -tlnp 'sport = :5061'

Linux / macOS: which process owns the port

sudo lsof -nP -i :5061

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':5061 '

Windows (Command Prompt)

netstat -ano | findstr :5061

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5061 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 5061

From Windows

Test-NetConnection HOST -Port 5061

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 5061 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 5061 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5061 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 5061 accept
sudo nft add rule inet filter input tcp dport 5061 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 5061 trusted' -Direction Inbound -Protocol TCP -LocalPort 5061 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.