Port 61616 (Apache ActiveMQ OpenWire)

ActiveMQ Classic OpenWire broker port.

Dynamic / private (ephemeral) port, 49152-65535 TCP Message queues Do not expose to the internet

What port 61616 is used for

ActiveMQ Classic OpenWire broker port.

Security: should port 61616 be open?

Do not expose to the internet. CVE-2023-46604 gave unauthenticated RCE through 61616 and was used by ransomware within days. Patch and never expose the broker.

IANA assignment

Port 61616 is in the dynamic range, which IANA never assigns. The usage above is unofficial but widespread.

Check what is listening on port 61616

Linux: is anything listening on TCP 61616?

sudo ss -tlnp 'sport = :61616'

Linux / macOS: which process owns the port

sudo lsof -nP -i :61616

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':61616 '

Windows (Command Prompt)

netstat -ano | findstr :61616

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 61616 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 61616

From Windows

Test-NetConnection HOST -Port 61616

Block port 61616 in the firewall

ufw

sudo ufw deny 61616/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 61616 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 61616 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 61616' -Direction Inbound -Protocol TCP -LocalPort 61616 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.