Port 514 (Syslog (UDP) / rsh (TCP))

UDP 514 is the classic syslog port for network devices sending logs. TCP 514 is officially rsh (remote shell), though many log collectors also accept syslog over TCP 514.

Well-known (system) port, 0-1023 UDPTCP Monitoring and logging Do not expose to the internet

What port 514 is used for

UDP 514 is the classic syslog port for network devices sending logs. TCP 514 is officially rsh (remote shell), though many log collectors also accept syslog over TCP 514.

Security: should port 514 be open?

Do not expose to the internet. Keep internal: syslog over UDP is unauthenticated and spoofable, and rsh is obsolete and insecure. Send logs over TLS (6514) across untrusted networks.

IANA assignment

Service nameProtoDescriptionAssigneeReference

shell TCP cmd like exec, but automatic authentication is performed as for login server - -

Check what is listening on port 514

Linux: is anything listening on TCP 514?

sudo ss -tlnp 'sport = :514'

Linux: UDP 514

sudo ss -ulnp 'sport = :514'

Linux / macOS: which process owns the port

sudo lsof -nP -i :514

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':514 '

Windows (Command Prompt)

netstat -ano | findstr :514

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 514 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 514

From Windows

Test-NetConnection HOST -Port 514

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 514

Block port 514 in the firewall

ufw

sudo ufw deny 514/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 514 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 514 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 514' -Direction Inbound -Protocol TCP -LocalPort 514 -Action Block

ufw

sudo ufw deny 514/udp